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Using This Manual 



This manual is designed to give you an introduction to the HP 64784 
H8/3003 Emulator. This manual will also help define how these 
emulators differ from other HP 64700 Emulators. 

This manual will: 

■ give you an introduction to using the emulator 

■ explore various ways of applying the emulator to accomplish 
your tasks 

■ show you emulator commands which are specific to the 
H8/3003 Emulator 



This manual will not: 



tell you how to use each and every emulator/analyzer 
command (refer to the User's Reference manual) 



Organization 

Chapter 1 



An introduction to the H8/3003 emulator features and how they can 
help you in developing new hardware and software. 



Chapter 2 

Chapter 3 
Chapter 4 

Appendix A 



A brief introduction to using the H8/3003 Emulator. You will load 
and execute a short program, and make some measurements using the 
emulation analyzer. 

How to plug the emulator probe into a target system. 

Configuring the emulator to adapt it to your specific measurement 
needs. 



H8/3003 Emulator Specific Command Syntax and Error Message 
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Introduction to the H8/3003 Emulator 

Introduction The topics in this chapter include: 

■ Purpose of the H8/3003 Emulator 

■ Features of the H8/3003 Emulator 



Purpose of the 
H8/3003 Emulator 



The H8/3003 Emulator is designed to replace the H8/3003 
microprocessor in your target system so you can control operation of 
the microprocessor in your application hardware (usually refer 
to as the target system). The H8/3003 emulator performs just like the 
H8/3003 microprocessor, but is a device that allows you to control the 
H8/3003 microprocessor directly. These features allow you to easily 
debug software before any hardware is available, and ease the task of 
integrating hardware and software. 
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LAN 

Connect i on 




Figure 1-1 . HP 64784 Emulator for the H8/3003 
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Features of the 
H8/3003 Emulator 



SU pported The HP 64784A H8/3003 emulator supports the microprocessors listed 
Microprocessors in Table 1-1. 



Table 1-1. Supported Microprocessors 



Supported Microprocessor 


QFP Adaptor 
Board 


PGA Adaptor 
Board/ 
QFP probe 


Type 


Package 


System 
Clock 
Divider 


On-chip ROM 


Supply Voltage 


H8/3005 


80pinQFP 






4.75 to 5.25V 
2.7 to 5.25V 




HP64 /84b/ 
HP64784K*1 


H8/3004 


80pinQFP 






4.75 to 5.25V 
2.7 to 5.25V 




HP64784E/ 
HP64784K*1 


H8/3003 


112 pin QFP 


1:2 




4.75 to 5.25V 
2.7 to 5.25V 


HP64784C 


HP64784E/ 
HP64784F 






4.75 to 5.25V 
2.7 to 5.25V 


H8/3002 


100 pin QFP 






4.75 to 5.25V 
2.7 to 5.25V 


HP64784D 


HP64784E/ 
HP64784G 


H8/3001 


80 pin QFP 






4.75 to 5.25V 




HP64784E/ 
HP64784J *1 
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Table 1-1. Supported Microprocessors (Cont'd) 



Supported Microprocessor 



Type 



Package 



System 
Clock 
Divider 



On-chip ROM 



Supply Voltage 

2.7 to 5.25V 



QFP Adaptor PGA Adaptor 
Board Board/ 
QFP probe 



H8/3032 



80 pin QFP 



PROM 



Masked ROM 



4.75 to 5.25V 
2.7 to 5.25V 
4.75 to 5.25 V 



2.7 to 5.25V 



HP64784E/ 
HP64784H 



H8/3031 



H8/3030 



80 pin QFP 



80 pin QFP 



4.75 to 5.25 V 



2.7 to 5.25 V 
4.75 to 5.25 V 
2.7 to 5.25 V 



HP64784E/ 
HP64784H 

HP64784E/ 
HP64784H 



H8/3042 



100 pin QFP 



H8/3041 



100 pin QFP 



4.75 to 5.25V 



PROM 



Masked ROM 



Masked ROM 



2.7 to 5.25V 
4.75 to 5.25V 
2.7 to 5.25V 
4.75 to 5.25V 



HP64784D 



HP64784D 



2.7 to 5.5V 



HP64784E/ 
HP64784G 



HP64784E/ 
HP64784G 



H8/3040 



100 pin QFP 



Masked ROM 



4.752 to 5.25V 
2.7 to 5.25V 



HP64784D 



HP64784E/ 
HP64784G 



*1 When you do in-circuit emulation for H8/3001 with mode 3/4 or 
H8/3004/5 with mode 3, you must use HP 64784-66509 shipped with 
HP 64784J/K. Refer to the "In-Circuit Emulation" Chapter in this 
manual for more details. 
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The H8/3003 emulator is provided without any QFP adaptors and PGA 
adaptor(HP 64784E) with QFP probe. To emulate each processor with 
your target system, you need to purchase appropriate QFP adaptor or 
PGA adaptor with QFP probe listed in Table 1-1. To purchase them, 
contact your local HP sales representative. 

You can buy HP 64797B low voltage adaptor to emulate each 
processor running with supply voltage from 2.7 up to 5.25V input in 
your target system. To buy HP 64797B, contact your local HP sales 
representative. 

The list of supported microprocessors in Table 1-1 is not necessarily 
complete. To determine if your microprocessor is supported or not, 
contact Hewlett-Packard. 

Clock Speeds You can select whether the emulator will be clocked by the internal 
clock source or by the external clock source on your target system. 
When you select a clock input conforming to the specification of Table 
1-2. 

Refer to the "Configuration the Emulator" Chapter in this manual for 
more details. 
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Table 1-2. C 


ock Speeds 


Clock source 


Ctiip 


Witnout o4/y/i> 


Willi wily ItS 


Internal 


H8/3001 


16MHz 


8MHz 




TTQ /^MHO 


(System clock) 


(System clock) 




H8/3003T 








H8/3004 








H8/3005 








H8/3030 








H8/3031 








H8/3032 








H8/3040 








H8/3041 








H8/3042 








rio/jUUj witn system 


oivlriz 


U \ IT I , 

oivlriz 




clock divider 


(System clock) 


(System clock) 


External 


H8/3001 


From 0.5 up to 16MHz 


From 0.5 up to 10MHz 






(System clock) 


(System clock) 




tjq nnnQT 








H8/3004 








H8/3005 








H8/3030 








H8/3031 








H8/3032 








H8/3040 








H8/3041 








H8/3042 








H8/3003 with system 


From 1 up to 24MHz 


From 1 up to 20MHz 




clock divider 


(System clock is from 


(System clock is from 






0.5 up to 12MHz) 


0.5 up to 10MHz) 
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Emulation memory The H8/3003 emulator is used with one of the following Emulation 

Memory Cards. 

■ HP 64726A 128K byte Emulation Memory Card 

■ HP 64727 A 5 1 2K byte Emulation Memory Card 

■ HP 64728 A 1M byte Emulation Memory Card 

■ HP 64729A 2M byte Emulation Memory Card 

You can define up to 16 memory ranges (at 512 byte boundaries and 
least 512 byte in length.) The emulator occupies 6K byte, which is 
used for monitor program and internal RAM of microprocessor mapped 
as emulation RAM, leaving 122K, 506K, 1018K, 2042K byte of 
emulation memory which you may use. You can characterize memory 
range as emulation RAM (eram), emulation ROM (erom), target 
system RAM (tram), target system ROM (trom), or guarded memory 
(grd). The emulator generates an error message when accesses are 
made to guarded memory locations. You can also configure the 
emulator so that writes to memory defined as ROM cause emulator 
execution to break out of target program execution. 



Analysis The H8/3003 emulator is used with one of the following analyzers 
which allows you to trace code execution and processor activity. 

■ HP 64704A 80-channel Emulation Bus Analyzer 

■ HP 64703A 64-channel Emulation Bus Analyzer and 
16-channel State/Timing Analyzer. 

■ HP 64794A/C/D Deep Emulation Bus Analyzer 

The Emulation Bus Analyzer monitors the emulation processor using 
an internal analysis bus. The HP 64703 A 64-channel Emulation Bus 
Analyzer and 16-channel State/Timing Analyzer allows you to probe 
up to 16 different lines in your target system. 



Registers You can display or modify the H8/3003 internal register contents. This 
includes the ability to modify the program counter (PC) value so you 
can control where the emulator starts a program run. 

Breakpoints You can set the emulator/analyzer interaction so the emulator will 

break to the monitor program when the analyzer finds a specific state or 
states, allowing you to perform post-mortem analysis of the program 
execution. You can also set software breakpoints in your program. 
This feature is realized by inserting a special instruction into user 
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program. One of undefined opcodes (5770 hex) is used as software 
breakpoint instruction. Refer to the "Using Software Breakpoints" 
section of "Getting Started" chapter for more information. 

Reset Support The emulator can be reset from the emulation system under your 
control; or your target system can reset the emulation processor. 

Real Time Operation Real-time signifies continuous execution of your program at full rated 

processor speed without interference from the emulator. (Such 
interference occurs when the emulator needs to break to the monitor to 
perform an action you requested, such as displaying target system 
memory.) Emulator features performed in real time include: running 
and analyzer tracing. Emulator features not performed in real time 
include: display or modification of target system memory, load/dump 
of target memory, display or modification of registers. 
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Limitations, 
Restrictions 

Foreground Monitor Foreground monitor is not supported for the H8/3003 emulator. 



DMA Support Direct memory access to the emulation by external DMAC is not 
allowed. 

Internal RAM of when you emulate H8/3005 processor, you can't use address OfeflOh 
H8/3005 OffOOfh (mode 1) and OffeflOh - OfffOOfh (mode 3) as internal RAM. 
These area are worked as external 8bit 3 state area. 



Watch Dog Timer in Watch dog timer is suspended count up while the emulator is running 
Backg rOU nd in background monitor. 



Monitor Break at 
Sleep/Standby Mode 



When the emulator breaks into the background monitor, sleep or 
software standby mode is released. Then, PC indicates next address of 
"SLEEP" instruction. 



Hardware Standby 
Mode 



Hardware standby mode is not supported for the H8/3003 emulator. 
Hardware standby request from target system will give the emulator 
reset signal. 



Interrupts in 
Background Cycles 



The H8/3003 emulator does not accept any interrupts while in 
background monitor. Such interrupts are suspended while running the 
background monitor, and will occur when context is changed to 
foreground. 



Reset Output Enable 
Bit 



The RSTOE (Reset output enable bit) is used to determine whether the 
H8/3003 processor outputs reset signal when the processor is reset by 
the watch dog timer. However, the H8/3003 emulator ignores the 
configuration of the RSTOE, and works as it is configured with the 
modify configuration command. 
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Evaluation Chip Hewlett-Packard makes no warranty of the problenm caused by the 
H8/3003 Evaluation chip in the emulator. 
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2 



Getting Started 



Introduction This chapter will lead you through a basic, step by step tutorial 

designed to familiarize you with the use of the HP 64700 emulator for 
the H8/3003 microprocessor. When you have completed this chapter, 
you will be able to perform these tasks: 

■ Set up an emulation configuration for out of circuit emulation 
use 

■ Map memory 

■ Transfer a small program into emulation memory 

■ Use run/stop controls to control operation of your program 

■ Use memory manipulation features to alter the program' s 
operation 

■ Use analyzer commands to view the real time execution of 
your program 

■ Use software breakpoint feature to stop program execution at 
specific address 

■ Search memory for strings or numeric expressions 

■ Make program coverage measurements 
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Before You Begin Before be ginning the tutorial presented in this chapter, you must have 

completed the following tasks: 



1. Completed hardware installation of the HP 64700 emulator in 
the configuration you intend to use for your work: 

Standalone configuration 

Transparent configuration 

Remote configuration 

2. If you are using the Remote Configuration, you must have 
completed installation and configuration of a terminal 
emulator program which will allow your host to act as a 
terminal connected to the emulator. In addition, you must start 
the terminal emulator program before you can work the 
examples in this chapter. 



3. If you have properly completed steps 1 and 2 above, you 
should be able to hit <RETURN> (or <ENTER> on some 
keyboards) and get one of the following command prompts on 
your terminal screen: 

U> 
R> 
M> 

If you do not see one of these command prompts, retrace your 
steps through the hardware and software installation 
procedures outlined in the manuals above, verifying all 
connections and procedural steps. If you are still unable to get 
a command prompt, refer to the HP 64700 Support Services 
Guide. The guide gives basic troubleshooting procedures. If 
this fails, call the local HP sales and service office listed in the 
Support Services Guide. 

In any case, you must have a command prompt on your 
terminal screen before proceeding with the tutorial. 
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A Look at the 
Sample Program 



The sample program "COMMAND_READER" used in this chapter is 
shown figure 2-1 . The program emulates a primitive command 
interpreter. 



Data Declarations 

Msg_A, Msg_B and Msg_I are the messages used by the program to 
respond to various command inputs. 

Initialization 

The locations of stack and input area(Cmd_Input) are moved into 
address registers for use by the program. Next, the CLEAR routine 
clears the command byte(the first location pointed to by Cmd_Input - 
0ff800 hex). Cmdjnput contains 00 hex for late use. 

Scan 

This routine continuously reads the byte at location of Cmdjnput until 
it is something other than a null character (00 hex); when this occurs, 
the Exe_Cmd routine is executed. 

Exe_Cmd 

Compares the input byte (now something other than a null) to the 
possible command bytes of "A" (ASCII 41 hex) and "B" (ASCII 42 
hex), then jumps to the appropriate set up routine for the command 
message. If the input byte does not match either of these values, a 
branch to a set up routine for an error message is executed. 

Cmd_A, Cmd_B, CmdJ 

These routines set up the proper parameters for writing the output 
message: the number of bytes in the message is moved to the R3L 
register and the base address of the message in the data area is moved 
to address register ER4. 
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Write_Msg 



First the base address of the output area is copied to ER5. Then the 
Clear_01d routine writes nulls to 32 bytes of the output area (this 
serves both to initialize the area and to clear old messages written 
during previous program passes). 

Finally, the proper message is written to the output area by the 
Write_Loop routine. When done, Write_Loop jumps back to Clear and 
the command monitoring process begins again. 

Using the various features of the emulator, we will show you how to 
load this program into emulation memory, execute it, monitor the 
program's operation with the analyzer, and simulate entry of different 
commands utilizing the memory access commands provided by the HP 
64700 command set. 
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5448495320495320 
4D45535341474520 
41 

5448495320495320 
4D45535341474520 
42 

494E56414C494420 
434F4D4D414E44 



002000 
002000 
002000 
002008 
002010 
002011 
002019 
002021 
002022 
00202A 
002031 

001000 



001000 7A07000FF904 
001006 7A01000FF800 



00100C F800 

00100E 6AA8000FF800 



001014 6A2A000FF800 
00101A AAOO 
00101C 47F6 



00101E AA41 
001020 5870000A 
001024 AA42 
001026 58700010 
00102A 58000018 



00102E FB11 

001030 7A0400002000 

001036 58000014 



00103A FB11 

00103C 7A0400002011 

001042 58000008 



10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
29 
30 
31 
32 
33 
34 
35 
36 
37 
38 
39 
40 
41 
42 
43 
44 
45 
46 
47 
48 



Msgs 
Msg_A 



Msg_B 

Msg_I 
End_Msgs 



. SECTION 
. SDATA 

. SDATA 

. SDATA 



Table, DATA, LOCATE=H' 2000 
"THIS IS MESSAGE A" 

"THIS IS MESSAGE B" 

"INVALID COMMAND" 



Prog, CODE, LOCATE=H' 1000 



. SECTION 

:************************************* 



;* Set up the Pointers. 

. **************************************************** 



#Stack,ER7 
#Cmd_Input, ER1 



#H' 00,R0L 
R0L, @Cmd_Input 



Init MOV.L 
MOV. L 

**************************************************** 

* Clear previous command. 

**************************************************** 
Clear MOV.B 
MOV.B 

**************************************************** 

* Read command input byte. If no command has been 

* entered, continue to scan for it. 

**************************************************** 
Scan MOV.B @Cmd_Input, R2L 

CMP.B #H'00,R2L 
BEQ Scan 

* A command has been entered. Check if it is 

* command A, command B, or invalid command. 
**************************************************** 

Exe_Cmd CMP.B #H'41,R2L 

BEQ Cmd_A 

CMP.B #H'42,R2L 

BEQ Cmd_B 

BRA Cmd_I 

* Command A is entered. R3L = the number of bytes 

* in message A. R4 = location of the message. 

* Jump to the routine which writes the message. 
**************************************************** 

Cmd_A MOV.B #Msg_B-Msg_A, R3L 

MOV.L #Msg_A,ER4 
BRA Write_Msg 

.**************************************************** 

;* Command B is entered. 

.**************************************************** 



Cmd_B 



MOV.B 
MOV. L 
BRA 



#Msg_I-Msg_B, R3L 
#Msg_B, ER4 
Write_Msg 



Figure 2-1 . Sample Program Listing 
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001046 FBOF 

001048 7A0400002022 



00104E 7A05000FF804 
001054 FE20 
001056 68D8 
001058 0B05 
00105A 1A0E 
00105C 46F8 



00105E 7A05000FF804 
001064 6C4E 
001066 68DE 
001068 0B05 
00106A 1A0B 
00106C 46F6 



00106E 409C 
0FF800 



0FF800 00000004 



0FF804 00000100 
0FF904 

00001000 



49 
50 
51 
52 
53 
54 
55 
56 
57 
58 
59 
60 
61 
62 
63 
64 
65 
66 
67 
68 
69 
70 
71 
72 
73 
74 
75 
76 
77 
78 
79 
80 
81 
82 
83 
84 
85 
86 
87 



. **************************************************** 
;* An invalid command is entered. 

.**************************************************** 



Cmd_I 



MOV.B 
MOV. L 



#End_Msgs-Msg_I, R3L 
#Msg_I, ER4 



t****************** 



* The destination area is cleared. 
**********************************■. 



t******* 



Write_Msg 
Clear_01d 
Clear_Loop 



MOV. L 
MOV.B 
MOV.B 
ADDS . L 
DEC . B 
BNE 



#Msg_Dest, ER5 
#H' 20, R6L 
R0L, @ER5 
#1,ER5 
R6L 

Clear_Loop 



t************************************** 



;* Message is written to the destination. 
.**************************************** 



t ***** * 



Write_Loop 



MOV. L 
MOV.B 
MOV.B 
ADDS . L 
DEC . B 
BNE 



#Msg_Dest, ER5 
@ER4+, R6L 
R6L, @ER5 
#1,ER5 
R3L 

Write_Loop 



.**************************************************** 
:* Go back and scan for next command. 

.**************************************************** 
BRA Clear 

. SECTION Data, DATA, LOCATE=H' FF800 

**************************************************** 

* Command input area. 

**************************************************** 
Cmd_Input .RES.L 1 

.**************************************************** 
;* Destination of the command messages. 

.**************************************************** 



Msg_Dest 
Stack 



.RES.W 
.END 



H' 80 
Init 



Figure 2-1. Sample Program Listing (Cont'd) 
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Using the Help If you need a quick reference to the Terminal Interface syntax, you can 

F3C i I ity US£ t ' 1C k uut ~i n h er P facilities. For example, to display the top level help 



menu, type: 
R> help 



help - display help information 

help <group> - print help for desired group 

help -s <group> - print short help for desired group 

help <command> - print help for desired command 

help - print this help screen 

VALID <group> NAMES 

gram - system grammar 

proc - processor specific grammar 



sys - system commands 

emul - emulation commands 

hi - highlevel commands (hp internal use only) 

trc - analyzer trace commands 

* - all command groups 



You can type the ? symbol instead of typing help. For example, if you 
want a list of commands in the emul command group, type: 

R> ? emul 



emul - emulation commands 



b 


. .break to monitor 


cp. . . 


. copy memory 


mo . . . 


. . modes 


be 


. .break condition 


dump . 


.dump memory 




. . run user code 


bp. . . 


. . breakpoints 


es . . . 


.emulation status 


reg . . 


. . registers 


cf 


. . configuration 


io . . . 


. input / output 


rst . . 


. .reset 


cim. . 


..copy target image 


load. 


. load memory 




. . run at CMB execute 


cmb . . 


..CMB interaction 


m. . . . 


. memory 


s . . . . 


. . step 


cov . . 


. . coverage 


map . . 


.memory mapper 


ser . . 


..search memory 



To display help information for any command, just type help (or ?) and 
the command name. For example: 

R> help load 
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load - download absolute file into processor memory space 



load 


-i 


load 


-m 


load 


-t 


load 


-S 


load 


-h 


load 


-a 


load 


-e 


load 


-u 


load 


-o 


load 


-s 


load 


-b 


load 


-x 


load 


-q 


load 


-p 


load 


-c 



<f ile> 



download intel hex format 
download motorola S-record format 
download extended tek hex format 
download sysmbol file 

download hp format (requires transfer protocol) 
reserved for internal hp use 
write only to emulation memory 
write only to target memory 

data received from the non-command source port 
send a character string out the other port 
data sent in binary (valid with -h option) 
data sent in hex ascii (valid with -h option) 
quiet mode 

record ACK/NAK protocol (valid with -imt options) 
data is received from the 64000 . file name format is : 
<f ilename> : <userid> : absolute 



Initialize the To initialize the emulator to a known state for this tutorial: 

Emulator to a 
Known State 



Note ££j It is especially important that you perform the following step if the 

emulator is being operated in a standalone mode controlled by only a 
data terminal. The only program entry available in this mode is 
through memory modification; consequently, if the emulator is 
reinitialized, emulation memory will be cleared and a great deal of 
tedious work could be lost. 



1. Verify that no one else is using the emulator or will have need 
of configuration items programmed into the emulator. 

2. Initialize the emulator by typing the command: 
R> init 
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Set Up the Proper 

Emulation 

Configuration 

Set Up Emulation To set the emulator's configuration values to the proper state for this 
Conditions tutorial, do this: 

1. Type: 
R> cf 

You should see the following configuration items displayed: 

cf ba=en 
cf chip=3042 
cf clk=int 
cf dbc=en 
cf drst=dis 
cf mode=7 
cf nmi=en 
cf rrt=dis 
cf rsp=9 
cf tdma=en 
cf trfsh=en 
cf trst=en 



Note MsL The individual configuration items won't be explained in this example; 

refer to Chapter 4 of this manual and the User's Reference manual for 
details. 



2. If the configuration items displayed on your screen don't 
match the ones listed above, here is how to make them agree: 

For each configuration item that does not match, type: 
R> cf <conf ig_item>=<value> 
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cf ba=en 

cf chip=3042 

cf clk=ext 

cf dbc=en 
cf drst=dis 
cf mode=7 
cf nmi=en 
cf rrt=en 
cf rsp=9 
cf tdma=en 
cf trfsh=en 
cf trst=en 



For example, if you have the following configuration items 
displayed (those in bold indicate items different from the list 
above): 



To make these configuration values agree with the desired 
values, type: 

R> cf clk=int 
R> cf rrt=dis 



3. Now, you need to set up stack pointer. 
Type: 

R> cf rsp=0ff904 



4. Let's go ahead and set up the proper break conditions. 
Type: 
R> be 

You will see: 

be -d bp tdisable 
be -e rom tenable 
be -d bnct #disable 
be -d cmbt #disable 
be -d trigl tdisable 
be -d trig2 #disable 

For each break condition that does not match the one listed, 
use one of the following commands: 

To enable break conditions that are currently disabled, type: 
R> be -e <breakpoint type> 

To disable break conditions that are currently enabled, type: 
R> be -d <breakpoint type> 

For example, if typing be gives the following list of break 
conditions: 
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be -d bp tdisable 
be -d rom #disable 
be -d bnct #disable 
be -d cmbt #disable 
be -e trigl #enable 
be -e trig2 #enable 



(items in bold indicate improper values for this example) 

Type the following commands to set the break conditions 

correctly for this example: 
R> be -e rom 

(this enables the write to ROM break) 
R> be -d trigl trig2 

(this disables break on triggers from the analyzer) 



Mapping Memory 



Depending on the memory board, emulation memory consists of 128K, 
512K, 1M or 2M bytes, mappable in 512 byte blocks. The monitor 
occupies 2K bytes and the emulator maps 4K bytes for internal RAM 
as emulation RAM automatically, leaving 122K, 506K, 1018K or 
2042K bytes of emulation memory which you may use. 



The memory mapper allows you to characterize memory locations. It 
allows you specify whether a certain range of memory is present in the 
target system or whether you will be using emulation memory for that 
address range. You can also specify whether the target system memory 
is ROM or RAM, and you can specify that emulation memory be 
treated as RAM od ROM. 



Type: 

R> map C.Offff erom 



To verify that memory blocks are mapped properly, type: 
R> map 
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You will see: 

# remaining number of terms : 15 

# remaining emulation memory : 6e800h bytes 
map 0000000 .. OOOffff erom # term 1 
map other tram 



4 



Note Ha You must map internal ROM as emulation memory. 



4 



Note Ma You don't have to map internal RAM, since the emulator maps internal 

RAM as emulation RAM. And the emulator memory system dose not 
introduce it in memory mapping display. 



Transfer Code 
into Emulation 
Memory 



Refer to "Memory Mapping" section of "Configuring the Emulator" 
chapter in this manual for more details. 



Transferring Code 
from a Terminal In 
Standalone 
Configuration 



To transfer code into emulation memory from a data terminal running 
in standalone mode, you must use the modify memory commands. 
This is necessary because you have no host computer transfer facilities 
to automatically download the code for you (as if you would if you 
were using the transparent configuration or the remote configuration.) 
To minimize the effects of typing errors, you will modify only one row 
of memory at a time in this example. Do the following: 

1. Enter the data information for the program by typing the 
following commands: 



R> m 002000. . 00200f =54 , 48 , 49, 53 , 20 , 49, 53 , 20 , 4d, 45 , 53 , 53 , 41 , 47 , 45 , 20 
R> m 002010. .00201f=41,54,48,49,53,20,49,53,20,4d,45,53,53,41,47,45 
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R> m 002020. . 00202f =20 , 42 , 49, 4e, 56 , 41 , 4c, 49, 44 , 20 , 43 , 4f , 4d, 4d, 41 , 4e 
R> m 002030=44 

You could also type the following line instead: 

R> m 002000="THIS IS MESSAGE ATHIS IS MESSAGE BINVALID COMMAND" 

2. You should now verify that the data area of the program is 
correct by typing: 

R> m 002000. .002030 

You should see: 

002000 .. 00200f 54 48 49 53 20 49 53 20 4d 45 53 53 41 47 45 20 
002010 .. 00201f 41 54 48 49 53 20 49 53 20 4d 45 53 53 41 47 45 
002020 .. 00202f 20 42 49 4e 56 41 4c 49 44 20 43 4f 4d 4d 41 4e 
002030 .. 002030 44 

If this is not correct, you can correct the errors by re-entering 
only the modify memory commands for the particular rows of 
memory that are wrong. 

For example, if row 002000.. 00200f shows these values: 

002000 .. 00200f 54 48 49 53 20 20 49 53 20 4d 45 53 53 41 47 45 



you can correct this row of memory by typing: 

R> m 002000. . 00200f=54, 48, 49, 53, 20, 49, 53, 20, 4d, 45, 53, 53, 41, 47, 45, 20 

Or, you might need to modify only one location, as in the 
instance where address 00200f equals 22 hex rather than 20 
hex. Type: 
R> m 00200f=22 



3. Enter the program information by typing the following 
commands: 

(Note the hex letters must be preceded by a digit.) 

R> m 001000. .00100f=7a,07,00,0f,0f9,04,7a,01,00,0f , Of 8 , 00 , Of 8 , 00 , 6a, 0a8 
R> m 001010. . 00101f=00, Of , Of 8, 00, 6a, 2a, 00, Of , Of 8, 00, Oaa, 00, 47, Of 6, Oaa, 41 
R> m 001020. . 00102f=58, 70, 00, 0a, Oaa, 42 , 58 , 70 , 00 , 10 , 58 , 00 , 00 , 18 , Ofb, 11 
R> m 001030. .00103f=7a, 04 , 00 , 00 , 20 , 00 , 58 , 00 , 00 , 14 , Ofb, 11, 7a, 04, 00, 00 
R> m 001040. .00104f=20, 11, 58, 00, 00, 08, Ofb, Of, 7a, 04, 00, 00, 20, 22, 7a, 05 
R> m 001050. .00105f=00,0f,0f8,04,0fe,20,68,0d8,0b,05,la,0e,46,0f8,7a,05 
R> m 001060. .00106f=00,0f,0f8,04,6c,4e,68,0de,0b,05,la,0b,46,0f6,40,9c 
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4. You should now verify that the program area is correct by 
typing: 

R> m 001000. .00106f 



You should see: 



001000. 


.00100f 


7a 


07 


00 


Of 


f 9 


04 


7a 


01 


00 


Of 


f8 


00 


f8 


00 


6a 


a8 


001010. 


. OOlOlf 


00 


Of 


f8 


00 


6a 


2a 


00 


Of 


f8 


00 


aa 


00 


47 


f 6 


aa 


41 


001020. 


. 00102f 


58 


70 


00 


0a 


aa 


42 


58 


70 


00 


10 


58 


00 


00 


18 


fb 


11 


001030 . 


. 00103f 


7a 


04 


00 


00 


20 


00 


58 


00 


00 


14 


fb 


11 


7a 


04 


00 


00 


001040 . 


. 00104f 


20 


11 


58 


00 


00 


08 


fb 


Of 


7a 


04 


00 


00 


20 


22 


7a 


05 


001050 . 


. 00105f 


00 


Of . 


E8 


04 . 


fe : 


20 f 


58 c 


18 Ob 


05 


la < 


Oe 


46 


f 8 


7a ■ 


35 


001060 . 


. 00106f 


00 


Of 


f 8 


04 


6c 


4e 


68 


de 


Ob 


05 


la 


Ob 


46 


f 6 


40 


9c 



If this is not correct, you can correct the errors by re-entering 
only the modify memory commands for the particular rows of 
memory that are wrong. 
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Transferring Code 
From A Host, HP 
64700 In Transparent 
Configuration 



The method provided in this example assumes that you are running an 
Assembler/Linkage Editor on an HP 9000/300 computer running the 
HP-UX operating system. In addition, you must have the HP 64000 
transfer software running on your host. 



If you are not using an Assembler/Linkage Editor, you may be able to 
adapt the methods below to load your code into the emulator (refer to 
the HP 64700 User's Reference manual for help). 

If you are not able to transfer code from your host to the emulator using 
one of these methods, use the method described previously under 
"Transferring Code From A Terminal In Standalone Mode", as it will 
work in all cases. However, transferring code using host transfer 
facilities is easier and faster than modifying memory locations, 
especially for large programs. 

1. First, you must establish communications with your host 
computer through the transparent mode link provided in the 
HP 64700. Type: 
R> xp -s 02a 

This sets the second escape character to "*".(The first escape 
character remains at the HP 64700 powerup default of hex 
01b, which is the ASCII <ESC>character.) The sequence 
"<ESC>*" toggles the transparent mode software within the 
HP 64700 for the duration of one command (that is, any valid 
line of HP 64700 commands (not exceed 254 characters) 
concatenated by semicolons and terminated by a <carriage 
return>). Refer to the User's Reference manual for more 
information on the xp command. 

Enable the transparent mode link by typing: 
xp -e 

If you then press <RETURN> a few times, you should see: 

This is the login prompt for an HP-UX host system. (Your 
prompt may differ depending on how your system manager 
has configured your system.) 



R> 



login : 
login : 
login : 
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2. Log in to your host system and start up an editor such as "vi". 
You should now enter the source code for the sample program 
shown at the beginning of the chapter. When finished, save 
the program to filename "sampprog.src". 



Note Wm If y° u nee d help learning how to log in to your HP-UX host system or 

use other features of the system, such as editors, refer to the HP-UX 
Concepts and Tutorials guides and your HP-UX system administrator. 



3. Assemble and link your code. 

4. Convert your absolute file generated above into HP format 
with the following command. This is needed to load the file 
into the emulator. 

S h83cnvhp -x sampprog 

An HP format absolute file sampprog.X will be generated. 

Now it's time to transfer your code into the emulator. Do the following: 

1. Disable the transparent mode so that your terminal will talk 
directly to the emulator. Type: 
$ <ESC>* xp -d 



The "<ESC>*" sequence temporarily toggles the transparent 
mode so that the emulator will accept commands; "xp -d" then 
fully disables the transparent mode. 

2. Load code into the emulator by typing: 
R> load -hbo 

transfer -rtb sampprog . X<ESC>* (NOTE: DO NOT 
TYPE CARRIAGE RETURN!) 

The system will respond: 

## 

R> 

load -hbo tells the emulator to load code expected in HP 
binary file format and to expect the data from the other port 
(the one connected to the host). It then puts you in 
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communication with the host; you then enter the transfer 
command to start the HP 64000 transfer utility. Typing 
"<ESC>*" tells the system to return to the emulator after 
transferring the code. The "##" marks returned by the system 
indicates that the emulator loaded two records from the host. 



3. At this point you should examine a portion of memory to 
verify that your code was loaded correctly. 



002000 . . 00200f 54 48 49 53 

002010 .. 00201f 41 54 48 49 

002020 .. 00202f 20 42 49 4e 

002030 .. 002030 44 



Type: 
R> m 2000. .2030 

You should see: 

20 49 53 20 4d 45 53 53 41 47 45 20 
53 20 49 53 20 4d 45 53 53 41 47 45 
56 41 4c 49 44 20 43 4f 4d 4d 41 4e 



If your system does not match, verify 1) that you entered the 
source code correctly; 2) that you entered the linker 
parameters correctly. 
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Looking at Your 
Code 



Now that you have loaded your code into emulation memory, you can 
display it in mnemonic format. Type: 



R> m -dm 1000 . . 106f 

You will see: 



0001000 
0001006 
000100c 
OOOlOOe 
0001014 
000101a 
000101c 
OOOlOle 
0001020 
0001024 
0001026 
000102a 
000102e 
0001030 
0001036 
000103a 
000103c 
0001042 
0001046 
0001048 
000104e 
0001054 
0001056 
0001058 
000105a 
000105c 
000105e 
0001064 
0001066 
0001068 
000106a 
000106c 
000106e 



MOV.L #000f f 904, ER7 
MOV.L #000f f 800, ER1 
MOV.B #00,R0L 
MOV.B R0L, @0ff800 
MOV.B @0ff800,R2L 
CMP.B #00,R2L 
BEQ 001014 
CMP.B #41,R2L 
BEQ 00102e 
CMP.B #42,R2L 
BEQ 00103a 
BRA 00104 6 
MOV.B #11,R3L 
MOV.L #00002000, ER4 
BRA 00104e 
MOV.B #11,R3L 
MOV.L #00002011, ER4 
BRA 00104e 
MOV.B #0f,R3L 
MOV.L #00002022, ER4 
MOV.L #000ff804,ER5 
MOV.B #20,R6L 
MOV.B R0L, @ER5 
ADDS #1,ER5 
DEC . B R6L 
BNE 00105 6 
MOV.L #000ff 804, ER5 
MOV.B @ER4+,R6L 
MOV.B R6L, @ER5 
ADDS #1,ER5 
DEC . B R3L 
BNE 001064 
BRA 00100c 
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Familiarize 
Yourself with the 
System Prompts 



Note 




The following steps are not intended to be complete explanations of 
each command; the information is only provided to give you some idea 



of the meanings of the various command prompts you may see and 
reasons why the prompt changes as you execute various commands. 



You should gain some familiarity with the HP 64700 emulator 
command prompts by doing the following: 

1. Ignore the current command prompt. Type: 
*> rst 

You will see: 

R> 

The rst command resets the emulation processor and holds it 
in the reset state. The "R>" prompt indicates that the 
processor is reset. 

2. Type: 
R> r 1000 

You will see: 

U> 

The r command runs the processor from address 1000 hex. 

3. Type: 
U> b 

You will see: 

M> 

The b command causes the emulation processor to "break" 
execution of whatever it was doing and begin executing within 
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the emulation monitor. The "M>" prompt indicates that the 
emulator is running in the monitor. 



Note Ma ^ DMA transfer is in progress with BURST transfer mode, b command 

tm is suspended and occurs after DMA transfer is completed. 



Running the 

Sample Program a. Type: 



M> r 1000 

The emulator changes state from background to foreground 
and begins running the sample program from location 1000 
hex. 



Note tta ^ e default number base for address and data values within HP 64700 

is hexadecimal. Other number bases may be specified. Refer to the 
Tutorials chapter of this manual or the HP 64700 User's Reference 
manual for further details. 



5. Let's look at the registers to verify that the address registers 
were properly initialized with the pointers to the input and 
output areas. Type: 
U> reg 

You will see: 



reg pc=001014 ccr=84 erO=00000000 erl=000ff800 er2=00000000 er3=00000000 
reg er4=00000000 er5=00000000 er6=00000000 er7=000ff904 sp=000ff904 mdcr=c7 

Notice that ER1 contains 0ff800 hex. 
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6. Verify that the input area command byte was cleared during 
initialization. 



Type: 



U> m -db 0ff800 



You will see: 



00ff800. .00ff800 



00 



The input byte location was successfully cleared. 

7. Now we will use the emulator features to make the program 
work. Remember that the program writes specific messages to 
the output area depending on what the input byte location 
contains. Type: 
U> m 0ff800=41 

This modifies the input byte location to the hex value for an 
ASCII "A". Now let's check the output area for a message. 
U> m Off 804. .Off 823 
You will see: 



These are the ASCII values for Msg_A. 

Repeat the last two commands twice. The first time, use 42 
instead of 41 at location ff800h and note that Msg_B 
overwrites Msg_A. Then try these again, using any number 
except 00, 41, or 42 and note that the Msg_I message is 
written to this area. 



00ff804 . . OOf f 813 
OOf f 814 . . 00ff823 



54 48 49 53 20 49 53 20 4d 45 53 53 41 47 45 20 
41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
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Stepping Through 

the Program 8. You can also direct the emulator processor to execute one 

instruction or number of instructions. Type: 
M> s 1 1000; reg 

This command steps 1 instruction from address 1000 hex, and 
displays registers. You will see: 

0001000 - MOV.L #000ff 904, ER7 

PC =0001006 

reg pc=001006 ccr=80 er0=00000000 erl=000ff800 er2=00000000 er3=00000000 
reg er4=00000000 er5=00000000 er6=00000000 er7=000ff904 sp=000ff904 mdcr=c7 

Notice that PC contains 1006 hex. 

9. To step one instruction from present PC, you only need to type 
s at prompt. Type: 
M> s ; reg 

You will see: 

0001006 - MOV.L #000ff 800, ER1 

PC =000100c 

reg pc=00100c ccr=80 er0=00000000 erl=000ff800 er2=00000000 er3=00000000 
reg er4=00000000 er5=00000000 er6=00000000 er7=000ff904 sp=000ff904 mdcr=c7 



Tracing Program 
Execution 

Predefined Trace Three trace labels are predefined in the H8/3003 emulator. You can 
Labels y i ew mese labels by entering the tlb (trace label) command with no 
options. 

M> tlb 

#### Emulation trace labels 
tlb addr 16. .39 
tlb data 0 . . 15 
tlb stat 40 . . 57 
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Common values for the H8/3003 status trace signals have been 
predefined. You can view these predefined equates by entering the equ 
command with no options. 

M> equ 

### Equates ### 
equ bg=OxxxOxxxxxxxxxxxxxxy 
equ byte=Oxxxxxxlxxxxlxxxxlxy 
equ cpu=Oxxxxxxlxxxxl lxxxxxy 
equ data=Oxxxxxxlxxxxlxlxxxxy 
equ dma=OxxxxxxlxxxxlOxxxxxy 
equ f etch=0xxxxxxlxlxxll0xx01y 
equ f g=Oxxxlxxxxxxxxxxxxxxy 
equ grd=0xxxx011xxxxlxxlxxxy 
equ intack=OxxxxxxxOxxxxxxxxxxy 
equ io=OxxxxxxlxxxxlxxOxxxy 
equ mem=Oxxxxxxlxxxxlxxlxxxy 
equ read=Oxxxxxxlxxxxlxxxxxly 
equ ref resh=OxxxxxxlxxxxO lxxxxxy 
equ word=OxxxxxxlxxxxlxxxxOxy 
equ wr ite=OxxxxxxlxxxxlxxxxxOy 
equ wrrom=0xxxxl01xxxxlxxlxx0y 



Predefined Status 
Equates 



These equates may be used to specify values for the stat trace label 
when qualifying trace conditions. 

Specifying a Trigger Now let's use the emulation analyzer to trace execution of the program. 

Suppose that you would like to start the trace when the analyzer begins 
writing data to the message output area. You can do this by specifying 
analyzer trigger upon encountering the address ff804 hex. 
Furthermore, you might want to store only the data written to the 
output area. This can be accomplished by modifying what is known as 
the "analyzer storage specification". 



Note Nfl For this example, you will be using the analyzer in the easy 

W configuration, which simplifies the process of analyzer measurement 

setup. The complex configuration allows more powerful measurements, 
but requires more interaction from you to set up those measurements. 
For more information on easy and complex analyzer configurations and 
the analyzer, refer to the HP 64700 Analyzer User's Guide and the 
User's Reference. 
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Now, let's set the trigger specification. Type: 
M> tg addr=0ff804 

To store only the accesses to the address range ff804 through ff815 hex, 
type: 

M> tsto addr=0ff804 . . Off 815 

Let's change the data format of the trace display so that you will see the 
output message writes displayed in ASCII format: 

M> tf addr,h data, A count, R seq 

Start the trace by typing: 
M> t 

You will see: 

Emulation trace started 

To start the emulation run, type: 
M> r 1000 

Now, you need to have a "command" input to the program so that the 
program will jump to the output routines (otherwise the trigger will not 
be found, since the program will never access address ff804 hex). Type: 

U> m 0ff800=41 

To display the trace list, type: 
U> tl 0. .34 

You will see: 
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Line addr,H data, A 



0 Of f 804 . . 

1 Of f 805 . . 

2 0ff806 .. 

3 Of f 807 . . 

4 Of f 808 . . 

5 0ff809 .. 

6 Of f 80a . . 

7 Of f 80b . . 

8 Of f 80c . . 

9 Of f 80d . . 

10 Of f 80e . . 

11 0ff80f . . 

12 Off 810 

13 0ff811 

14 0ff812 

15 Off 813 .. 

16 0ff814 

17 0ff815 

18 0ff804 TT 

19 0ff805 HH 

20 0ff806 II 

21 0ff807 SS 

22 Of f 808 

23 0ff809 II 

24 0ff80a SS 

25 Of f 80b . . 

26 0ff80c MM 

27 0ff80d EE 

28 0ff80e SS 

29 0ff80f SS 

30 0ff810 AA 

31 0ff811 GG 

32 0ff812 EE 

33 Off 813 .. 
34 



count, R seq 



0.760 uS 

0.720 uS 

0.760 uS 

0.760 uS 

0.760 uS 

0.720 uS 

0.760 uS 

0.760 uS 

0.760 uS 

0.720 uS 

0.760 uS 

0.760 uS 

0.760 uS 

0.720 uS 

0.760 uS 

0.760 uS 

0.760 uS 

12.00 uS 

1.120 uS 

1.120 uS 

1.120 uS 

1.120 uS 

1.120 uS 

1.120 uS 

1.120 uS 

1 .160 uS 

1.120 uS 

1.120 uS 

1.120 uS 

1.120 uS 

1.120 uS 

1.120 uS 

1.120 uS 



If you look at the last lines of the trace listing, you will notice that the 
analyzer seems to have stored only part of the output message, even 
though you specified more than the full range needed to store all of the 
message. The reason for this is that the analyzer has a storage pipeline, 
which holds states that have been acquired but not yet written to trace 
memory. To see all of the states, halt the analyzer by typing: 

U> th 
You will see: 

Emulation trace halted 

Now display the trace list: 
U> tl 0. .34 

You will see: 
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Line addr,H data, 



0 Of f 804 . . 

1 Of f 805 . . 

2 0ff806 . . 

3 Of f 807 . . 

4 Of f 808 . . 

5 0ff809 .. 

6 Of f 80a . . 

7 Of f 80b . . 

8 Of f 80c . . 

9 Of f 80d . . 

10 Of f 80e . . 

11 0ff80f . . 

12 0ff810 

13 0ff811 

14 0ff812 

15 Off 813 .. 

16 0ff814 

17 0ff815 

18 0ff804 TT 

19 0ff805 HH 

20 0ff806 II 

21 0ff807 SS 

22 Of f 808 . . 

23 0ff809 II 

24 0ff80a SS 

25 Of f 80b . . 

26 0ff80c MM 

27 0ff80d EE 

28 0ff80e SS 

29 0ff80f SS 

30 0ff810 AA 

31 0ff811 GG 

32 0ff812 EE 

33 Off 813 .. 

34 0ff814 AA 



count, R seq 



0.760 uS 

0.720 uS 

0.760 uS 

0.760 uS 

0.760 uS 

0.720 uS 

0.760 uS 

0.760 uS 

0.760 uS 

0.720 uS 

0.760 uS 

0.760 uS 

0.760 uS 

0.720 uS 

0.760 uS 

0.760 uS 

0.760 uS 

12.00 uS 

1.120 uS 

1.120 uS 

1.120 uS 

1.120 uS 

1.120 uS 

1.120 uS 

1.120 uS 

1.160 uS 

1.120 uS 

1.120 uS 

1.120 uS 

1.120 uS 

1.120 uS 

1.120 uS 

1.120 uS 

1.160 uS 



As you can see, all of the requested states have been captured by the 
analyzer. 
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Using Software 
Breakpoints 



You can stop program execution at specific address by using bp 
(software breakpoint) command. When you define a software 
breakpoint to a certain address, the emulator will replace the opcode 
with one of undefined opcode (5770 hex) as software breakpoint 
instruction. When the emulator detects the special instruction, user 
program breaks to the monitor, and the original opcode will be placed 
at the breakpoint address. A subsequent run or step command will 
execute from this address. 

If the special instruction was not inserted as the result of bp command 
(in other words, it is part of the user program), the "Undefined software 
breakpoint" message is displayed. 



4 



Note mJ. You can set software breakpoints only at memory locations which 

contain instruction opcodes (not operands or data). If a software 
breakpoint is set at a memory location which is not an instruction 
opcode, the software breakpoint instruction will never be executed and 
the break will never occur. 



Note njsl Because software breakpoints are implemented by replacing opcodes 

with the software breakpoint instruction, you cannot define software 
breakpoints in target ROM. You can, however, copy target ROM into 
emulation memory by cim command. (Refer to HP 64700 Terminal 
Interface User's Reference manual.) 



Before you can define software breakpoints, you must enable software 
breakpoints with the be (break conditions) command. To view the 
default break conditions and change the software breakpoint condition, 
enter the following commands. 

M> be 

be -d bp #disable 
be -e rom tenable 
be -d bnct #disable 
be -d cmbt #disable 



Displaying and 
Modifying the Break 
Conditions 
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be -d trigl #disable 
be -d trig2 tdisable 



M> be -e bp 



Defining a Software 
Breakpoint 



Now that the software breakpoint is enabled, you can define software 
breakpoints. Enter the following command to break on the address of 
the Write_Msg label. 

M> bp 104e 



Run the program and verify that execution broke at the appropriate 
address. 

M> r 1000 

U> m 0ff800=41 

!ASYNC_STAT 615! Software break point: 000104e 

M> reg 

reg pc=00104e ccr=80 er0=00000000 erl=000ff800 er2=00000041 er3=00000011 
reg er4=00002000 er5=00000000 er6=00000000 er7=000ff904 sp=000ff904 mdcr=c7 

Notice that PC contains 104e. 



When a breakpoint is hit, it becomes disabled. You can use the -e 
option to the bp command to re-enable the software breakpoint. 

M> bp 



###BREAKPOINT FEATURE IS ENABLED### 
bp 000104e tdisabled 

M> bp -e 104e 

M> bp 

###BREAKPOINT FEATURE IS ENABLED### 
bp 000104e #enabled 

M> r 1000 

U> m 0ff800=41 

!ASYNC_STAT 615! Software breakpoint: 000104e 

M> bp 

###BREAKPOINT FEATURE IS ENABLED### 
bp 000104e #disabled 
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Searching 
Memory for 
Strings or 
Numeric 
Expressions 



The HP 64700 Emulator provides you with tools that allow you to 
search memory for data strings or numeric expressions. For example, 
you might want to know exactly where a string is loaded. To locate the 
position of the string "THIS IS MESSAGE A" in the sample program. 
Type: 



M> ser 2000. .2fff="THIS IS MESSAGE A" 



pattern match at address: 



0002000 



You can also find numeric expressions. For example, you might want 
to find all of the CMP.B instructions in the sample program. Since a 
CMP.B instruction begins with aa hex, you can search for that value by 
typing: 

M> ser -db 10000 .. 106f=0aa 



pattern match at address: 000101a 
pattern match at address: OOOlOle 
pattern match at address: 0001024 



Making Program 

Coverage 

Measurements 



In testing your program, you will often want to verify that all possible 
code segments are executed. With the sample program, we might want 
to verify that all of the code is executed if a command "A", command 
"B", and an unrecognized command are input to the program. 



To make this measurement, we must first reset the coverage status. 
M> cov -r 
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Note Ma You should always reset the coverage status before making a coverage 

measurement. Any emulator system command which accesses 
emulation memory will affect the coverage status bit, resulting in 
measurement errors if the coverage status is not reset. 



Now, run the program and input the three commands: 

M> r 1000 
M> m 0ff800=41 
M> m 0ff800=42 
M> m 0ff800=43 

Make the coverage measurement: 
U> cov 1000 . . 106f 

percentage of memory accessed: % 100.0 



Trace Analysis 
Considerations 



There are some points you need to attend to in using the emulation 
analyzer. The following section describes such points. 



HOW tO Specify the Suppose that you would like to start the trace when the program begins 
Trigger Condition executing Exe_Cmd routine. 



To initialize the emulation analyzer, type: 
U> tinit 

To set the trigger condition, type: 
U> tg addr=101e 

Start the trace and modify memory so that the program will jump to the 
Exe_Cmd routine: 

U> t 

U> m 0ff800=41 

To display the trace list, type: 
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U> tl 0. .20 



Line addr,H H8/3042 mnemonic, H count, R seq 



0 


OOlOle 


aa41 fetch 


mem 











1 


001014 


MOV.B @0ff800, 


R2L 




0 


120 


uS 


2 


001016 


OOOf fetch 


mem 




0 


120 


uS 


3 


001018 


f800 fetch 


mem 




0 


120 


uS 


4 


00101a 


CMP.B #00,R2L 






0 


120 


uS 


5 


0ff800 


OOxx read 


mem 


byte 


0 


120 


uS 


6 


00101c 


BEQ 001014 






0 


120 


uS 


7 


OOlOle 


aa41 fetch 


mem 




0 


160 


uS 


8 


001014 


MOV.B @0ff800, 


R2L 




0 


120 


uS 


9 


001016 


OOOf fetch 


mem 




0 


120 


uS 


10 


001018 


f800 fetch 


mem 




0 


120 


uS 


11 


00101a 


CMP.B #00,R2L 






0 


120 


uS 


12 


Of f 800 


OOxx read 


mem 


byte 


0 


120 


uS 


13 


00101c 


BEQ 001014 






0 


120 


uS 


14 


OOlOle 


aa41 fetch 


mem 




0 


120 


uS 


15 


001014 


MOV.B @0ff800, 


R2L 




0 


160 


uS 


16 


001016 


OOOf fetch 


mem 




0 


120 


uS 


17 


001018 


f800 fetch 


mem 




0 


120 


uS 


18 


00101a 


CMP.B #00,R2L 






0 


120 


uS 


19 


0ff800 


OOxx read 


mem 


byte 


0 


120 


uS 


20 


00101c 


BEQ 001014 






0 


120 


uS 



This is not what we were expecting to see. (We expected to see the 
program executed Exe_Cmd routine which starts from lOle hex.) As 
you can see at the fist line of the trace list, address lOle hex appears on 
the address bus during the program executing Scan loop. This triggered 
the emulation analyzer before EXE_Cmd routine was executed. To 
avoid mis-trigger by this cause, set the trigger condition to the second 
instruction of the routine you want to trace. Type: 

U> tg addr=1020 

To change the trigger position so that 10 states appear before the trigger 
in the trace list, type: 

U> tp -b 10 

Start the trace again and modify memory: 
U> t 

U> m 0ff800=41 

Now display the trace list: 
U> tl -10. .10 



As you can see, the analyzer captured the execution of Exe_Cmd 
routine which starts from line -2 of the trace list. 
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Line addr,H H8/3042 mnemonic, H 



count, R seq 



10 


00101c 


BEQ 001014 


0 


120 


uS 


-9 


OOlOle 


aa41 fetch mem 


0 


120 


uS 


-8 


001014 


MOV.B @0ff800,R2L 


0 


120 


uS 


-7 


001016 


OOOf fetch mem 


0 


120 


uS 


-6 


001018 


f800 fetch mem 


0 


120 


uS 


-5 


00101a 


CMP.B #00,R2L 


0 


160 


uS 


-4 


0ff800 


41xx read mem byte 


0 


120 


uS 


-3 


00101c 


BEQ 001014 


0 


120 


uS 


-2 


OOlOle 


CMP.B #41,R2L 


0 


120 


uS 


-1 


001014 


6a2a unused fetch mem 


0 


120 


uS 


0 


001020 


BEQ 00102e 


0 


120 


uS 


1 


001022 


000a fetch mem 


0 


120 


uS 


2 


00102e 


MOV.B #11,R3L 


0 


280 


uS 


3 


001030 


MOV.L #00002000, ER4 


0 


120 


uS 


4 


001032 


0000 fetch mem 


0 


120 


uS 


5 


001034 


2000 fetch mem 


0 


120 


uS 


6 


001036 


BRA 00104e 


0 


120 


uS 


7 


001038 


0014 fetch mem 


0 


120 


uS 


8 


00104e 


MOV.L #000ff804,ER5 


0 


240 


uS 


9 


001050 


OOOf fetch mem 


0 


160 


uS 


10 


001052 


f804 fetch mem 


0 


120 


uS 



Store Condition and When you specify store condition with tsto command, disassembling of 
Disassembling program execution may not be accurate. 



Type: 

U> tinit 

U> t 

U> tl 0. .20 
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Line addr,H H8/3042 mnemonic, H 



count, R seq 



0 


001016 


OOOf fetch mem 











1 


001018 


f800 fetch mem 




0 


120 


uS 


2 


00101a 


CMP.B #00,R2L 




0 


160 


uS 


3 


0ff800 


OOxx read mem 


byte 


0 


120 


uS 


4 


00101c 


BEQ 001014 




0 


120 


uS 


5 


OOlOle 


aa41 fetch mem 




0 


120 


uS 


6 


001014 


MOV.B @0ff800,R2L 




0 


120 


uS 


7 


001016 


OOOf fetch mem 




0 


120 


uS 


8 


001018 


f800 fetch mem 




0 


120 


uS 


9 


00101a 


CMP.B #00,R2L 




0 


120 


uS 


10 


0ff800 


OOxx read mem 


byte 


0 


160 


uS 


11 


00101c 


BEQ 001014 




0 


120 


uS 


12 


OOlOle 


aa41 fetch mem 




0 


120 


uS 


13 


001014 


MOV.B @0ff800,R2L 




0 


120 


uS 


14 


001016 


OOOf fetch mem 




0 


120 


uS 


15 


001018 


f800 fetch mem 




0 


120 


uS 


16 


00101a 


CMP.B #00,R2L 




0 


120 


uS 


17 


0ff800 


OOxx read mem 


byte 


0 


120 


uS 


18 


00101c 


BEQ 001014 




0 


160 


uS 


19 


OOlOle 


aa41 fetch mem 




0 


120 


uS 


20 


001014 


MOV.B @0ff800,R2L 




0 


120 


uS 



The program is executing Scan loop. 

Now, specify the store condition so that only accesses to the address 
range 1000 hex through lOff hex will be stored: 

U> tsto addr=1000. .10ff 

Start the trace and display the trace list: 
U> t 

U> tl 0. .20 



Line 


addr, H 


H8/3042 mnemonic, H 


count , R 


0 


00101c 


BEQ 001014 








1 


OOlOle 


aa41 fetch mem 


0 


. 120 


uS 


2 


001014 


MOV.B @0ff800,R2L 


0 


. 120 


uS 


3 


001016 


OOOf fetch mem 


0 


. 120 


uS 


4 


001018 


f800 fetch mem 


0 


. 120 


uS 


5 


00101a 


aaOO fetch mem 


0 


. 120 


uS 


6 


00101c 


BEQ 001014 


0 


.280 


uS 


7 


OOlOle 


aa41 fetch mem 


0 


. 120 


uS 


8 


001014 


MOV.B @0ff800,R2L 


0 


. 120 


uS 


9 


001016 


OOOf fetch mem 


0 


. 120 


uS 


10 


001018 


f800 fetch mem 


0 


. 120 


uS 


11 


00101a 


aaOO fetch mem 


0 


. 120 


uS 


12 


00101c 


BEQ 001014 


0 


.240 


uS 


13 


OOlOle 


aa41 fetch mem 


0 


. 120 


uS 


14 


001014 


MOV.B @0ff800,R2L 


0 


.160 


uS 


15 


001016 


OOOf fetch mem 


0 


. 120 


uS 


16 


001018 


f800 fetch mem 


0 


. 120 


uS 


17 


00101a 


aaOO fetch mem 


0 


. 120 


uS 


18 


00101c 


BEQ 001014 


0 


.240 


uS 


19 


OOlOle 


aa41 fetch mem 


0 


. 120 


uS 


20 


001014 


MOV.B @0ff800,R2L 


0 


.160 


uS 
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As you can see, the executions of CMP.B instruction are not 
disassembled. This occurs when the analyzer cannot get necessary 
information for disassembling because of the store condition. Be 
careful when you use the store condition. 

You may want to trigger the emulation analyzer when specific data 
appears on the data bus. You can accomplish this with the following 
command. 

U> tg data=<data> 

There are some points to be noticed when you trigger the analyzer in 
this way. You always need to specify the <data> with 16 bits value 
even when access to the data is performed by byte access. This is 
because the analyzer is designed so that it can capture data on internal 
data bus (which has 16 bits width). The following table shows the way 
to specify the trigger condition by data. 



Location of 
data 


Access 
size 


Address 
value 




Available 
<data> Specification 


8 bit data 
bus area 




even 


-+— 


ddxx 


*1 


byte/word |- 
+ 


odd 


-+— 


xxdd 


*1 






even 


1 

-+— 


ddxx 


*1 


16 bit data 
bus area 


1 byte I - 
+- 


odd 


1 

-+— 


xxdd 


*1 


word 


even 


t 


hhll 


*2 



*1 dd means 8 bits data 
*2 hhll means 16 bits data 

For example, to trigger the analyzer when the processor performs word 
access to data 1234 hex in 16 bit bus area, you can specify the 
following: 

U> tg data=1234 

To trigger the analyzer when the processor accesses data 12 hex to the 
even address located in 8 bit data bus area: 

U> tg data=12xx 



Triggering the 
Analyzer by Data 
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On the other hand, to trigger 12 hex to the odd address located 8 bit 
data bus. 

U> tg data=0xxl2 

Notice that you always need to specify "xx" value to capture byte 
access to 8 bit data bus area. Be careful to trigger the analyzer by data. 

You're now finished with the "Getting Started" example. You can 
proceed on with using the emulator and use this manual and the 
Terminal Interface Reference manual as needed to answer your 
questions. 
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Notes 
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3 



In-Circuit Emulation 



When you are ready to use the H8/3003 emulator in conjunction with 
actual target system hardware, there are some special considerations 
you should keep in mind. 

■ installing the emulator probe 

■ properly configure the emulator 

We will cover the first topic in this chapter. For complete details on 
in-circuit emulation configuration, refer to Chapter 4. 



3-1 In-Circuit Emulation 



Installing the 
Target System 
Probe 



Caution BHj T' le following precautions should be taken while using the H8/3003 

emulator. Damage to the emulator circuitry may result if these 
precautions are not observed. 

Power Down Target System. Turn off power to the user target system 
and to the H8/3003 emulator before attaching and detaching the QFP 
adaptor to the emulator or target system to avoid circuit damage 
resulting from voltage transients or mis-insertion of the QFP board. 

Verify User Plug Orientation. Make certain that Pin 1 of the QFP 

socket/adaptor and Pin 1 of the QFP adaptor are properly aligned 
before inserting the QFP adaptor the QFP socket/adaptor. Failure to do 
so may result in damage to the emulator circuitry. 

Protect Against Static Discharge. The H8/3003 emulator and the QFP 
adaptor contain devices which are susceptible to damage by static 
discharge. Therefore, operators should take precautionary measures 
before handling the user plug to avoid emulator damage. 

Compatibility of VOLTAGE/CURRENCY. Please be sure to check 
that the voltage/currency of the emulator and target system being 
connected are compatible. If there is a discrepancy, damage may result. 

Protect Target System CMOS Components. If your target system 
includes any CMOS components, turn on the target system first, then 
turn on the H8/3003 emulator; when powering down, turn off the 
emulator first, then turn off power to the target system. 



3-2 In-Circuit Emulation 



The H8/3003 emulator is provided without any QFP adaptor or PGA 
adaptor with QFP probe. To emulate each processor with your target 
system, you need to purchase appropriate QFP adaptor or PGA adaptor 
with QFP probe. 

QFP adaptor To emulate each processor with your target system, you need to 

purchase appropriate adaptor listed in Table 1-1. The QFP adaptor 
allows you to connect the emulation probe to your target system using 
the QFP socket/adaptor provided with the QFP adaptor. 

PGA adaptor To emulate each processor with your target system, you need to use HP 
64784E PGA adaptor as shown in Figure 3-2. The PGA adaptor allows 
you to connect the emulation probe to QFP socket/adapter on your 
target system through the QFP probe listed in Table 1-1. 



Caution 




Do not apply strong force to QFP probe, as that might damage the 
QFP probe. 



To emulate H8/3001 processor with mode 3/4 or H8/3004/05 processor 
with mode 3, you must use HP 64784-66509 board as shown in Figure 
3-3 and 3-4. Connecting the emulator and your target system without 
this board causes serious damage, when you emulate in these cases. 



Caution 




Always detach HP 64784-66509 except you emulate H8/3001 
processor with mode 3/4 or H8/3004/5 with mode 3. 



3-3 In-Circuit Emulation 



QFP SOCket/adaptOr The QFP socket/adaptor is provided with the QFP adaptor and QFP 

probe, and designed for H8/3003 microprocessor. To do in-circuit 
emulation, you must attach the QFP socket/adaptor to your target 
system and connect with the QFP adaptor or PGA adaptor. 



Note 




You can order additional QFP socket/adaptor with part No. HP 
64784-6161 l(for H8/3003), HP 64784-61612(for H8/3002/4x), HP 
64784-61613(for H8/3004/05/3x) or HP 64784-61614(for H8/3001). 



3-4 In-Circuit Emulation 



Installing the QFP 
Adaptor 



1. Attach the QFP socket/adaptor to your target system. 



2. Connect the QFP adaptor to the emulation probe. 

3. Install the QFP adaptor to the QFP socket/adaptor on your 
target system as shown in Figure 3-1. 




Figure 3-1. Installing the QFP adaptor 
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Installing the 64784E 

PGA adaptor 1. Attach the QFP socket/adaptor to your target system. 



2. Connect the 64784E PGA adaptor to the emulation probe. 

3. Install the 64784E PGA adaptor to the QFP socket/adaptor on 
your target system through QFP probe(or QFP probe and HP 
64784-66509) as shown in Figure 3-2,3-3 and 3-4. 




HP B4784F/G/H/J 



Figure 3-2 Installing the PGA adaptor (General) 



3-6 In-Circuit Emulation 




Pin 1 of the QFP 
socket/adaptor 




Figure 3-3 Installing the PGA adaptor (3001 mode 3/4) 



3-7 In-Circuit Emulation 




3-8 In-Circuit Emulation 



Installing the H8/3003 You can replace the QFP/PGA adaptor with H8/3003 microprocessor, 
microprocessor Refer to the Figure 3-5. 




Figure 3-5 Installing the H8/3003 microprocessor 



3-9 In-Circuit Emulation 



Using Low 
Voltage Adaptor 



You can use optional low voltage adaptor with the H8/3003 emulator. 
The low voltage adaptor gives you a feature to emulate your target 
system running with supply voltage from 2.7V up to 5.25V. 



Specification You must conform input high voltage(Vih) to the specification of Table 
3-1, when you use the low voltage adaptor with the H8/3003 emulator. 



Table 3-1. DC Characteristics of input high voltage 



Item 


Minimum (V) 


PI - P5, DO - D15 


Vcc x 0.7 




or 




2.4 *1 


Others 


Vcc x 0.7 




or 




2.0 *1 



1 Higher of the two. 



Note 




This is different from the target processor's specification. 



4 



Note Mm You must also use a clock conforming to the specification of Table 4-1, 

when you use the low voltage adaptor and configure the emulator to 
use external clock. 
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Installing the 64797B 
PGA adaptor 



1. Attach the QFP socket/adaptor to your target system. 



2. Connect the 64797B PGA adaptor to the emulation probe. 

3. Install the 64797B PGA adaptor to the QFP socket/adaptor on 
your target system through QFP probe(or QFP probe and HP 
64784-66509) as shown in Figure 3-6. 




HP B4784F/G/H/J 



Figure 3-6 Installing the PGA adaptor (General) 



3-11 In-Circuit Emulation 



Note 




You have to use HP 64784-66509 when you emulate H8/3001 with 
mode 3/4 or H8/3004/05 with mode 3. 



Run from Target 
System Reset 



You can use "r rst" command to execute program from target system 
reset. You will see T> system prompt when you enter "r rst". In this 
status, the emulator accept target system reset. Then program starts if 
reset signal from target system is released. 



4 



Note Ma * n t ' le "Awaiting target reset" status(T>), you can not break into the 

monitor. If you enter "r rst" in out-of-circuit or in the configuration that 
emulator does not accept target system reset (cf trst=dis), you must 
reset the emulator. 
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Electrical The AC characteristics of the HP 64784 H8/3003 emulator are listed in 

Characteristics the followin g table 



Table 3-2. Bus timing (Vcc = 5.0V, f = 16MHz) 



Characteristics 


Symbol 


H8/3003 

Vcc = 5V 
f=16MHz 


Probe Type 


Unit 


HP 64784E 
+ 

HP 64784x 


HP 64784D 


min 


max 


typ *1 


worst 


typ*l 


worst 


Clock cycle time 


tcyc 


62.5 


500 


- 


- 


- 


- 


ns 


Clock pulse low width 


tCL 


20 




23.2 


12.9 


23.8 


13.3 


ns 


Clock pulse high width 


tCH 


20 




28.3 


12.9 


28.3 


13.3 


ns 


Clock rise time 


tCR 




10 


5.6 


17.1 


5.0 


16.7 


ns 


Clock fall time 


tCF 




10 


5.4 


17.1 


5.4 


16.7 


ns 


Address delay time 


tAD 




30 


24.0 


33.5 


23.6 


32.0 


ns 


Address hold time 


tAH 


10 




41.0 


-4.8 


41.2 


-5.2 


ns 


Address strobe delay time 


tASD 




30 


7.4 


35.8 


6.6 


34.7 


ns 


Write strobe delay time 


tWSD 




30 


10.0 


35.8 


9.6 


34.7 


ns 


Strobe delay time 


tSD 




30 


2.8 


35.8 


3.0 


34.7 


ns 


Write data strobe pulse width 1 


twswi 


35 




53.0 


28.6 


53.8 


29.1 


ns 


Write data strobe pulse width 2 


tWSW2 


65 




83.0 


58.6 


83.8 


59.1 


ns 
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Table 3-2. Bus timing (Vcc = 5.0V, f = 16MHz) (Cont'd) 



Characteristics 


Symbol 


H8/3003 

Vcc = 5V 
f=16MHz 


Probe Type 


Unit 


HP 64784E 
+ 

HP 64784x 


HP 64784D 


min 


max 


typ*l 


worst 


typ*l 


worst 


Address setup time 1 


tASl 


1 M 




y.o 


O/l 1 
-Z4.1 


1U.D 


-Li.L 


ns 


Address setup time 2 


tAS2 


/in 
4U 




A 1 A 
41 .4 


j.y 


4Z.Z 


D.O 


ns 


Read data setup time 


tRDS 






a 


AQ H 

4y. / 


Z4.U 


ah ^ 
4/. J 


ns 


Read data hold time 


tRDH 


U 




-LI X) 


Zy. 1 


-zu.o 




ns 


Write data delay time 


tWDD 




60 


29.0 


68.7 


29.8 


69.9 


ns 


Write data setup time 1 


tWDSl 


35 




31.0 


-4.8 


30.0 


-6.6 


ns 


Write data setup time 2 


tWDS2 


5 




3.2 


-36.0 


2.4 


-37.8 


ns 


Write data hold time 


tWDH 


20 




47.2 


4.4 


47.6 


5.8 


ns 


Read data access time 1 


tACCl 




55 


42.4 


21.3 


51.2 


24.8 


ns 


Read data access time 2 


tACC2 




115 


104.0 


83.8 


112.8 


87.2 


ns 


Read data access time 3 


tACC3 




25 


25.8 


-12.3 


33.4 


-9.2 


ns 


Read data access time 4 


tACC4 




85 


87.2 


50.2 


94.8 


53.3 


ns 


Pre-charge time 


tPCH 


35 




62.8 


28.6 


62.8 


29.1 


ns 
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Table 3-2. Bus timing (Vcc = 5.0V, f = 16MHz) (Cont'd) 







H8/3003 


Probe Type 




Characteristics 


Symbol 


Vcc = 5V 
f=16MHz 


HP 64784E 
+ 

HP 64784x 


HP 64784D 


Unit 






min 


max 


typ*l 


worst 


typ*l 


worst 




WAIT setup time 


tWTS 


25 




26.2 


60.9 


22.6 


54.7 


ns 


WAIT set hold time 


tWTH 


5 




-23.6 


-11.0 


-20.0 


-6.1 


ns 


BREQ setup time 


tBRQS 


40 






75.9 




69.7 


ns 


BACK delay time 1 


tBACDl 




30 


10.4 


35.8 


10.0 


34.7 


ns 


BACK delay time 2 


tBACD2 




30 


-4.2 


35.8 


-4.0 


34.7 


ns 


Bus floating time 


tBZD 




40 


19.0 


46.2 


20.4 


44.7 


ns 



1 Typical outputs measured with 50pF load 
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Table 3-3. Refresh controller timing (Vcc = 5.0V, f = 16MHz) 



Characteristics 


Symbol 


H8/3003 

Vcc = 5V 
f=16MHz 


Probe Type 


Unit 


HP 64784E 
+ 

HP 64784x 


HP 64784D 


min 


max 


typ*l 


worst 


typ*l 


worst 


RAS delay time 1 


tRADl 




JU 


Zi.o 


A 1 

41.0 


1 /.O 




ns 


RAS delay time 2 


IRAD2 






LL.L 


41.0 


10. z 




ns 


RAS delay time 3 


tRAD3 






o.U 


A 1 A 
41.0 


0.0 




ns 


Row address hold time 


tRAH 


1 c 

1 J 




zz.u 


i n c 
-1U.J 




-y.o 


ns 


RAS pre-charge time 


tRP 


35 




60.8 


25.8 


61.4 


26.7 


ns 


CAS to RAS pre-charge time 


tCRP 


35 




61.4 


28.6 


60.2 


29.1 


ns 


CAS pulse width 


tCAS 


40 




52.8 


33.6 


53.2 


34.1 


ns 


RAS access time 


tRAC 




85 


74.4 


44.4 


82.8 


49.0 


ns 


Address access time 


tAA 




55 


42.4 


21.3 


51.2 


24.8 


ns 


CAS access time 


tCAC 




25 


23.0 


-12.3 


30.6 


-9.2 


ns 


Write data setup time 3 


tWDS3 


40 




33.8 


-4.8 


33.4 


-6.6 


ns 


CAS setup time 


tCSR 


15 




24.2 


11.6 


24.2 


11.0 


ns 


Read strobe delay time 


tRSD 




30 


9.0 


35.8 


9.6 


34.7 


ns 



1 Typical outputs measured with 50pF load 
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Table 3-4. Control signal timing (Vcc = 5.0V, f = 16MHz) 



Characteristics 


Symbol 


H8/3003 

Vcc = 5V 
f=16MHz 


Probe Type 


Unit 


HP 64784E 
+ 

HP 64784x 


HP 64784D 


min 


max 


typ*l 


worst 


typ*l 


worst 


RES setup time 


tRESS 


200 


- 


- 


281.9 


- 


275.7 


ns 


RES pulse width 


tRESW 


1 n 












tcyc 


RESO output delay time 


tRESD 




100 




109.6 




108.4 


ns 


RESO output pulse width 


tRESOW 


132 












tcyc 


NMI setup time 


tNMIS 


150 






231.9 




225.7 


ns 


NMI hold time 


tNMIH 


10 






-9.0 




-4.1 


ns 


Interrupt pulse width 


tNMIW 


200 






209.2 




208.3 


ns 


Crystal oscillator setting 
time(reset) 


tosci 


20 












ms 


Crystal oscillator setting time 
(software standby) 


tOSC2 


8 












ms 



1 Typical outputs measured with 50pF load 
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Table 3-5. Timing condition of On-chip supporting modules 
(Vcc = 5.0V, f = 16MHz) 







H8/3003 


Probe Type 




Characteristics 


Symbol 


Vcc = 5V 
f=16MHz 


HP 64784E 
+ 

HP 64784x 


HP 64784D 


Unit 






min 


max 


typ *1 


worst 


typ*l 


worst 










30 






65.9 




59.7 




DMA 


1 ' 1 V 1 iv^ . » w L LI 1 / L11J.1V/ 


tDRQS 


- 


- 


- 


ns 








10 






-6 0 




-1.1 






DREQ hold time 


tDRQH 








ns 




TEND delay time 1 


tTEDl 




50 




61.6 




59.0 


ns 




TEND delay time 2 


tTED2 




50 




61.6 




59.0 


ns 


ITU 


Timer outputdelay time 


tTOCD 




100 




111.6 




109.0 


ns 




Timer input setup time 


tries 


50 






85.9 




79.7 


ns 




Timer clock input setup 
time 


tTCKS 


50 






85.9 




79.7 


ns 




Timer clock pulse width 
(single edge) 


tTCKWH 


1.5 












tcyc 




Timer clock pulse width 
(both edge) 


tTCKWL 


2.5 












tcyc 
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Table 3-5. Timing condition of On-chip supporting modules (Cont'd) 

(Vcc = 5.0V, f = 16MHz) 



Characteristics 


Symbol 


H8/3003 

Vcc = 5V 
f=16MHz 


Probe Type 


Unit 


HP 64784E 
+ 

HP 64784x 


HP 64784D 


min 


max 


typ *1 


worst 


typ*l 


worst 


SCI 


Tnnut clock' pvpIp^ A*;vnp^ 


tSCYC 


A 

T- 












tcyc 


Input clock cycle(Sync) 


tSCYC 


A 
u 












tcyc 


Input clock rise time 


tSCKr 




1.5 










tscyc 


Input clock fall time 


tSCKf 




1.5 










tscyc 


Input clock pulse width 


tSCKw 


0.4 


0.6 










tscyc 


Transmit data delay time 


tTXD 




100 




105.8 




104.7 


ns 


Received data setup time 


tRXS 


100 






136.8 




128.4 


ns 


Received data hold time 
(Clock input) 


tRXH 


100 






109.2 




108.3 


ns 


PORT 
TPC 


Output data delay time 


tPWD 




100 




111.6 




109.0 


ns 


Input data setup time 


tPRS 


50 






85.9 




79.7 


ns 


Input data hold time 


tPRH 


50 






37.0 




40.8 


ns 



! 1 Typical outputs measured with 50pF Load 
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Table 3-6. Bus timing (Vcc = 3.0V, f = 10MHz) 



Characteristics 


Symbol 


H8/3003 

Vcc = 3V 
f=10MHz 


Probe Type 


Unit 


HP 64797B 
+ 

HP 64784x 


min 


max 


typ*l 


worst 


Clock cycle time 


tcyc 


1 MM 


can 
jUU 






ns 


Clock pulse low width 


tCL 






/II Q 
4Z.O 




ns 


Clock pulse high width 


tCH 






40. U 




ns 


Clock rise time 


tCR 




1 ^ 


4 8 

i . o 


17 3 


ns 


Clock fall time 


tCF 




15 


6.4 


17.3 


ns 


Address delay time 


tAD 




50 


23.0 


33.9 


ns 


Address hold time 


tAH 


20 




42.2 


12.6 


ns 


Address strobe delay time 


tASD 




40 


7.8 


36.6 


ns 


Write strobe delay time 


tWSD 




50 


10.4 


36.6 


ns 


Strobe delay time 


tSD 




50 


3.4 


36.6 


ns 


Write data strobe pulse width 1 


twswi 


60 




88.7 


64.7 


ns 


Write data strobe pulse width 2 


tWSW2 


110 




137.5 


113.4 


ns 
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Table 3-6. Bus timing (Vcc = 3.0V, f = 10MHz) (Cont'd) 



Characteristics 


Symbol 


H8/3003 

Vcc = 3V 
f=10MHz 


Probe Type 


Unit 


HP 64797B 
+ 

HP 64784x 


min 


max 


typ*l 


worst 


Address setup time 1 


tASl 


1 c 

1 J 




OQ A 


-O.J 


ns 


Address setup time 2 


tAS2 


CO 




/y. 1 


4Z.4 


ns 


Read data setup time 


tRDS 


3< 




1 Q A 
JO.4 


JZ.O 


ns 


Read data hold time 


tRDH 


U 




-jj.U 


ZO. 1 


ns 


Write data delay time 


tWDD 




75 


27.8 


69 A 


ns 


Write data setup time 1 


tWDSl 


65 




68.1 


31.4 


ns 


Write data setup time 2 


t\VDS2 


10 




23.1 


-18.6 


ns 


Write data hold time 


tWDH 


20 




66.3 


22.0 


ns 


Read data access time 1 


tACCl 




100 


107.8 


74.4 


ns 


Read data access time 2 


tACC2 




200 


206.9 


MA A 


ns 


Read data access time 3 


tACC3 




50 


72.2 


21.7 


ns 


Read data access time 4 


tACC4 




150 


171.1 


121.7 


ns 


Pre-charge time 


tPCH 


60 




100.3 


64.7 


ns 
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Table 3-6. Bus timing (Vcc = 3.0V, f = 10MHz) (Cont'd) 







H8/3003 


Probe Type 




Characteristics 


Symbol 


Vcc = 3V 
f=10MHz 


HP 64797B 
+ 

HP 64784x 


Unit 






min 


max 


typ*l 


worst 




WAIT setup time 


tWTS 


40 




30.2 


63.1 


ns 


WAIT set hold time 


tWTH 


10 




-27.6 


-13.0 


ns 


BREQ setup time 


tBRQS 


40 






78.1 


ns 


BACK delay time 1 


tBACDl 




50 


10.8 


36.6 


ns 


BACK delay time 2 


tBACD2 




50 


-4.0 


36.6 


ns 


Bus floating time 


tBZD 




70 


17.8 


46.6 


ns 



1 Typical outputs measured with 50pF load 
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Table 3-7. Control signal timing (Vcc = 3.0V, f = 10MHz) 



Characteristics 


Symbol 


H8/3003 

Vcc = 3V 
f=10MHz 


Probe Type 

HP 64797B 
+ 

HP 64784x 


Unit 


min 


max 


typ*l 


worst 


RES setup time 


tRESS 


200 






284.1 


ns 


RES pulse width 


tRESW 


10 








tcyc 


RESO output delay time 


tRESD 




100 




110.3 


ns 


RFSO ontnnt nulsp width 


tRESOW 


132 








tcyc 


NMI setup time 


tNMIS 


150 






234.1 


ns 


NMI hold time 


tNMIH 


10 






-11.0 


ns 


Interrupt pulse width 


tNMIW 


200 






209.2 


ns 


Crystal oscillator setting time(reset) 


tosci 


20 








ns 


Crystal oscillator setting time 
(software standby) 


tOSC2 


8 








ns 



1 Typical outputs measured with 50pF load 
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Table 3-8. Timing condition of On-chip supporting modules 
(Vcc = 3.0V, f = 10MHz) 







H8/3003 


Probe Type 




Characteristics 


Symbol 


Vcc = 3V 
f=10MHz 


HP 64797B 
+ 

HP 64784x 


Unit 






min 


max 


typ*l 


worst 




ITU 


Timer output delay time 


tTOCD 


- 


100 


- 


111.6 


ns 




Timer input setup time 


tTICS 


50 


- 


- 


88.1 


ns 




Timer clock input setup time 


tTCKS 


50 


- 


- 


88.1 


ns 




Timer clock pulse width 
(single edge) 


tTCKWH 


1.5 


- 


- 


- 


tcyc 




Timer clock pulse width 
(both edge) 


tTCKWL 


2.5 


- 


- 


- 


tcyc 


SCI 


Input clock cycle(Async) 


tSCYC 


4 








tcyc 




Input clock cycle(Sync) 


tSCYC 


6 








tcyc 




Input clock rise time 


tSCKr 




1.5 






tcsyc 




Input clock fall time 


tSCKf 




1.5 






tscyc 




Input clock pulse width 


tSCKw 


0.4 


0.6 






tscyc 




Transmit data delay time 


tTXD 




100 




106.6 


ns 




Received data setup time 


tRXS 


100 






138.8 


ns 




Received data hold time (Clock 
input) 


tRXH 


100 






109.2 


ns 



3-24 In-Circuit Emulation 



Table 3-8. Timing condition of On-chip supporting modules (Cont'd) 

(Vcc = 3.0V, f = 10MHz) 



Characteristics 


Symbol 


H8/3003 

Vcc = 3V 
f=10MHz 


Probe Type 


Unit 


HP 64797B 
+ 

HP 64784x 


min 


max 


typ*l 


worst 


PORT 
TPC 


Output data delay time 


tPWD 




100 




111.6 


ns 


Input data setup time 


tPRS 


50 






88.1 


ns 


Input data hold time 


tPRH 


50 






35.6 


ns 



1 Typical outputs measured with 50pF load 
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Target System 
Interface 



;-5V 



10K 



cable 

0 «-h^^>AA/V 



74HBT244 



/RES, /STBY, NMI 



+ 5V 



R5T 

STBY 

NMI 



5 1 



cabl 



51 



10K 



74HCT14 



MDO-2 



10K 



c ab 1 e 

MD(0 :2 ) -Q Q-A/W 

51 



-> 74HCT14 
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/RESO 



cable 

™ < — 0=^A/W 

5 1 




GRL20V8 



PI, P2, P5 (AO-23) 



PI 
P2 
P5 




G/R 



P3, P4 (DO-15) 



V 

P4 





74QST3384 


• 




Bus S/H 




74QST3384 





G- 


-R 




74RBT 
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P6, P8, P9, PA, PB, PC 



PE(0) PB(0:3) 
PS (2:5) 
PRC 0:3) PB(B:7) 
PC(3) PC(5:7) 



— vw-o= 

51 



=OA/W 

51 



• +5V 

<> 10K 






H8/300H 


< • 



f5V 



10K 



cable 

P6u> — WW^^A/W 

5 1 5 1 



H8/300H 



► ;-L- : ZV:i 



^5V 



10K 



c ab 1 e 

Other - Q C ^^^- 

5 1 



H8/300H 
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P7, AVcc, Vref,AVss 

cable 



Vref 
P7 

RVss 



=0- 



51 



TTiTt 





k 




k 


Die 


de 




Die 


de 





k 


Diode 




a 
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Configuring the H8/3003 Emulator 



In this chapter, we will discuss: 

■ how to configure the HP 64700 emulator for H8/3003 
microprocessor to fit your particular measurement needs. 

■ some restrictions of HP 64700 emulator for H8/3003 
microprocessor. 



Types of Emulator 
Configuration 



Emulation Processor 
to Emulator/Target 
System 



These are the commands which are generally thought of as 
"configuration" items in the context of other HP 64700 emulator 
systems. The commands in this group set up the relationships between 
the emulation processor and the target system, such as determining how 
the emulator responds to requests for the processor bus. Also, these 
commands determine how the emulation processor interacts with the 
emulator itself; memory mapping and the emulator's response to 
certain processor actions are some of the items which can be configured. 



These commands are the ones which are covered in this chapter. 
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Commands Which 
Perform an Action or 
Measurement 



Several of the emulator commands do not configure the emulator; they 
simply start an emulator program run or other measurement, begin or 
halt an analyzer measurement, or allow you to display the results of 
such measurements. 

These commands are covered in the examples presented in earlier 
manual chapters; they are also covered in the HP 64700 Terminal 
Interface Reference manual. 



Coord i nated These commands determine how the emulator interacts with other 
Measurements measurement instruments, such as external analyzers, or other HP 

64700 emulators connected via the CMB (Coordinated Measurement 
Bus). 

These commands are covered in the HP 64700 CMB User's Guide and 
in the HP 64700 Terminal Interface Reference Manual. 



Analyzer The analyzer configuration commands are those commands which 
actually specify what type of measurement the analyzer is to make. 

Some of the analyzer commands are covered earlier in this manual. 
You can also refer to the HP 64700 Terminal Interface: Analyzer 
User's Guide and the HP 64700 Terminal Interface Reference manual. 



System This last group of commands is used by you to set the emulator's data 
communications protocol, load or dump contents of emulation 
memory, set up command macros, and so on. 

These commands are covered earlier in this manual and in the manual 
titled HP 64700 Terminal Interface: User's Reference. 
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Emulation As noted before, these commands determine how the emulation 

PrOCGSSOT tO processor will interact with the emulator's memory and the target 

S y Stem during an emulation measurement. 

Emulator/Target 
System 



cf ba=en 
cf chip=3042 
cf clk=int 
cf dbc=en 
cf drst=dis 
cf mode=7 
cf nmi=en 
cf rrt=dis 
cf rsp=9 
cf tdma=en 
cf trfsh=en 
cf trst=en 



Cf The cf command defines how the emulation processor will respond to 
certain target system signals. 

To see the default configuration settings defined by the cf command, 
type: 

M> cf 
You will see: 



Let's examine each of these emulator configuration options, with a 
view towards how they affect the processor's interaction with the 
emulator. 
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Cf ba The ba (bus arbitration) configuration item defines how your emulator 
responds to bus request signals from the target system. 

M> cf ba=en 

When bus arbitration is enabled, the /BREQ (bus request) signal from 
the target system is responded to exactly as it would be if only the 
emulation processor was present without an emulator. In other words, if 
the emulation processor receives a /BREQ from the target system, it 
will respond by asserting /BACK and will set the various processor 
lines to tri-state. /BREQ is then released by the target; /BACK is 
negated by the processor, and the emulation processor restarts 
execution. 

M> cf ba=dis 

When you disable bus arbitration by entering the above command, the 
emulator ignores the /BREQ signal from the target system. The 
emulation processor will never drive the /BACK line true; nor will it 
place the address, data and control signals into the tri-state mode. 

Enabling and disabling bus master arbitration can be useful to you in 
isolating target system problems. For example, you may have a 
situation where the processor never seems to execute any code. You 
can disable bus arbitration using cf ba=dis to check and see if faulty 
arbitration circuitry in your target system is contributing to the problem. 



Note 



Note 




When bus arbitration is enabled, the emulator responds to /BREQ 
signal during both foreground and background operation. 



The commands which cause the emulator to break to monitor are 
ignored during the processor releases bus cycles. 
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Note Hfl Executing this command will drive the emulator into the reset state. 



Cf Chip The chip configuration item defines the microprocessor you emulate. 
M> cf chip=<chip_name> 

Valid <chip_name> are the following: 



<chip_name> Description 

3001 Emulate H8/3001 microprocessor. 

3002 Emulate H8/3002 microprocessor. 
3003t Emulate H8/3003 microprocessor. 

3003 Emulate H8/3003 microprocessor with system 
clock divider. 

3004 Emulate H8/3004 microprocessor. 

3005 Emulate H8/3005 microprocessor. 

3030 Emulate H8/3030 microprocessor. 

3031 Emulate H8/303 1 microprocessor. 

3032 Emulate H8/3032 microprocessor. 

3040 Emulate H8/3040 microprocessor. 

3041 Emulate H8/3041 microprocessor. 

3042 Emulate H8/3042 microprocessor. 
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Note 




Executing this command will drive the emulator into the reset state. 



Cf Clk The elk (clock) option allows you to select whether the emulation 
processor's clock will be sourced by your target system or by the 
emulator. 

M> cf clk=int 

You can select the emulator's internal system clock using the above 
command. 

M> cf clk=ext 

You can specify that the emulator should use the clock input to the 
emulator probe from the target system. You must use a clock input 
conforming to the specifications of Table 4- 1 . 



Table 4-1. C 


ock Speeds 


Clock source 


Chip 


Without 64797B 


With 64797B 


Internal 


H8/3001 


16MHz 


8MHz 




H8/3002 


(System clock) 


(System clock) 




H8/3003T 








H8/3004 








H8/3005 








H8/3030 








H8/3031 








H8/3032 








H8/3040 








H8/3041 








H8/3042 








H8/3003 with system 


8MHz 


8MHz 




clock divider 


(System clock) 


(System clock) 
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Table 4-1. Clock Speeds(Cont'd) 



Clock source 


Chin 


w linoui 04 / v / r> 


With <£4707R 
Willi 04/V/r> 


External 


H8/3001 


From 0.5 up to 16MHz 


From 0.5 up to 10MHz 




no/jUUZ 


(System clock) 


(System clock) 




no/jUUj 1 








H8/3004 








H8/3005 








H8/3030 








H8/3031 








H83032 








H8/3040 








H8/3041 








H8/3042 








H8/3003 with system 


From 1 up to 24MHz 


From 1 up to 20MHz 




clock divider 


(System clock is from 


(System clock is from 






0.5 up to 12MHz) 


0.5 up to 10MHz) 



Note 




Executing this command will drive the emulator into the reset state. 



Cf dbC The dbc (drive background cycles) option allows you to select whether 
or not the emulator will drive the target system bus on background 
cycles. 

M> cf dbc=en 

You can enable background cycle drive to target system by entering the 
above command. Emulation processor's address and control strobes 
(except /LWR and /HWR) are driven during background cycles. 

Background write cycles won't appear to the target system. (/LWR and 
/HWR signals are always "high" when the dbc option is enabled.) 

M> cf dbc=dis 

If you specify the above command, background monitor cycles are not 
driven to the target system. 
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You use the dbc option to avoid target system interaction problems. 
For example, your target system interaction scheme may depend on the 
constant repetition of bus cycles. In such case, using the dbc option 
will help avoid the problem. 



Note K> Refresh cycles, internal DMA cycles and target memory access are 

always driven to the target system regardless of this configuration. 



4 



Note Ma When dbc is disabled, the emulator can't respond to fW AIT signal. 



Note Executing this command will drive the emulatoi into the resel state. 



Cf drst The drst (drive reset) configuration item allows you to specify whether 
or not the emulator drives the /RESO signal to the target system by the 
Watchdog Timer. 

M> cf drst=dis 

The above command configures the emulator not to drive the reset 
signal to the target. 

M> cf drst=en 

The emulator will drive the reset signal to the target system by the 
Watchdog Timer. 
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The RSTOE (Reset output enable bit) is used to determine whether the 
H8/3003 processor outputs reset signal when the processor is reset by 
the watchdog timer. However, the H8/3003 emulator ignores the 
configuration of the RSTOE, and works as it is configured with cf drst 
command. 



Cf mode The mode (cpu operation mode) configuration item defines operation 
mode in which the emulator works. 

M> cf mode=ext 



The emulator will work using the mode setting by the target system. 
The target system must supply appropriate inputs to MDO, MD1 and 
MD2. 

M> cf mode=<mode_num> 

When <mode_num> is selected, the emulator will operate in selected 
mode regardless of the mode setting by the target system. 

Valid <mode_num> are following: 
<mode_num> Description 

1 The emulator will operate in mode 1 . (expanded 1M 



bytes mode without internal ROM: 8 bit data bus) 



2 



The emulator will operate in mode 2. (expanded 1M 
bytes mode without internal ROM: 16 bit data bus) 



3 



The emulator will operate in mode 3. (expanded 
16M bytes mode without internal ROM: 8 bit data 
bus) 



4 



The emulator will operate in mode 4. (expanded 
16M bytes mode without internal ROM: 16 bit data 
bus) 



5 



The emulator will operate in mode 5. (expanded 1M 
bytes mode with internal ROM: 8 bit data bus) 
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The emulator will operate in mode 6. (single chip 
normal mode) 

The emulator will operate in mode 7. (single chip 
advanced mode) 



Note WSm It is recommended to specify operation mode number in this 

»T configuration, since the emulator does not work fine when MD0,MD1 
and MD2 are not steady. 



Note Ma When you emulate H8/3004/05, cf mode = ext is not available. You 

W have to configure processor mode using cf mode=<mode_num> 



Note Nfl When mismatch takes place between cf chip and cf mode, the emulator 

W will operate in mode which you don't specify. 



Not© 1^ Executing this command will drive the emulator into the reset state. 
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cf nmi The nmi (non maskable interrupt) configuration item determines 

whether or not the emulator responds to NMI signal from the target 
system during foreground operation. 

M> cf nmi=en 

Using the above command, you can specify that the emulator will 
respond to NMI from the target system. 

M> cf nmi=dis 

The emulator won't respond to NMI from the target system. 

The emulator does not accept any interrupt while in background 
monitor. Such interrupts are suspended while running the background 
monitor, and will occur when context is changed to foreground. 



Note 




Executing this command will drive the emulator into the reset state. 



Cf irt The rrt (restrict to real time) option lets you configure the emulator so 
that commands which cause the emulator to break to monitor and 
return to the user program will be rejected by the emulator command 
interpreter. 

M> cf rrt=en 

You can restrict the emulator to accepting only commands which don't 
cause temporary breaks to the monitor by entering the above command. 
Only the following emulator run/stop commands will be accepted: 

rst (resets emulation processor) 

b (breaks processor to background monitor until you enter another 
command) 

r (runs the emulation processor from a given location) 

s (steps the processor through a piece of code — returns to monitor after 
each step) 
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Commands which cause the emulator to break to the monitor and 
return, such as reg, m (for target memory display), and others will be 
rejected by the emulator. 



Caution H| If y° ur target system circuitry is dependent on constant execution of 

™ program code, you should set this option to cf rrt=en. This will help 

insure that target system damage doesn't occur. However, remember 
that you can still execute the rst, b and s commands; you should use 
caution in executing these commands. 



M> cf rrt=dis 

When you use this command, all commands, regardless of whether or 
not they require a break to the emulation monitor, are accepted by the 
emulator. 

Cf rsp The rsp (reset stack pointer) configuration item allows you to specify a 
value to which the stack pointer will be set upon the transition from 
emulation reset into the emulation monitor. 

R> cf rsp=XXXXXXXX 

where XXXXXXXX is a 32-bit even address, will set the stack pointer 
to that value upon entry to the emulation monitor after an emulation 
reset. You cannot set rsp at the following location. 

■ Odd address 

■ Internal I/O register area 

For example, to set the stack pointer to OffOO hex, type: 
R> cf rsp=0ff00 

Now, if you break the emulator to monitor using the b command, the 
stack pointer will be modified to the value OffOO hex. 
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Without a stack pointer, the emulator is unable to make the transition to 
the run state, step, or perform many other emulation functions. 
However, using this option does not preclude you from changing the 
stack pointer value or location within your program; it just sets the 
initial conditions to allow a run to begin. 



Cf tdma The tdma (trace internal DMA cycles) configuration item defines 
whether or not the emulator traces internal DMA cycles. 

M> cf tdma=en 

When you enable this item with the above command, each time DMA 
performed, one emulation analyzer state will be generated to recognize 
the DMA cycle. 

M> cf tdma=dis 

When disabled, no analyzer state will be generated at the occurrence of 
DMA. Therefore, any DMA cycle will be ignored by the analyzer. 



Note 




Internal DMA cycles may be traced regardless of this configuration in 
order to disassemble the trace list correctly. 



Cf trfsh The trfsh (trace refresh cycles) configuration item defines whether or 
not the emulator traces refresh cycles. 

M> cf trfsh=en 

When you enable this item with the above command, refresh cycles are 
traced by the emulation analyzer. 

M> cf trfsh=dis 

When disabled, refresh cycles are not traced by the analyzer. 
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Note 




Refresh cycles may be traced regardless of this configuration in order 
to disassemble the trace list correctly. 



Note 




Executing this command will drive the emulator into the reset state. 



Cf trst The trst (target reset) configuration item allows you to specify whether 
or not the emulator responds to /RES and /STBY signals from the 
target system during foreground operation. When running the 
background monitor, the emulator ignores such signals. 

M> cf trst=en 

When you enable target system reset with the above command, the 
emulator will respond to /RES input during foreground operation. 

M> cf trst=dis 

When disabled, the emulator won't respond to /RES and /STBY inputs 
from the target system. 




/RES and /STBY signals are always ignored during background 
operation regardless of this configuration. 



Note Ma Th e H8/3003 dose not support hardware standby mode, and /STBY 

■r input will be given the emulator /RES input. 
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Note 




Executing this command will drive the emulator into the reset state. 



Memory Mapping Before you begin an emulator session, you must specify the location 

and type of various memory regions used by your programs and your 
target system (whether or not it exists). You do this for several reasons: 

■ the emulator must know whether a given memory location 
resides in emulation memory or in target system memory. This 
allows the emulator to properly orient buffers for the given 
data transfer. 

■ the emulator needs to know the size of any emulation memory 
blocks so it can properly reserve emulation memory space for 
those blocks. 

■ the emulator must know if a given space is RAM (read/write), 
ROM (read only), or doesn't exist. This allows the emulator to 
determine if certain actions taken by the emulation processor 
are proper for the memory type being accessed. For example, 
if the processor tries to write to a emulation memory location 
mapped as ROM, the emulator will not permit the write (even 
if the memory at the given location is actually RAM). (You 
can optionally configure the emulator to break to the monitor 
upon such occurrence with the be -e rom command.) Also, if 
the emulation processor attempts to access a non existent 
location (known as "guarded"), the emulator will break to the 
monitor. 

You use the map command to define memory ranges and types for the 
emulator. The H8/3003 emulator memory mapper allows you to define 
up to 16 different map terms; each map term has a minimum size of 
512 bytes. If you specify a value less than 512 byte, the emulator will 
automatically allocate an entire block. You can specify one of five 
different memory types (erom, eram, trom, tram, grd). 

For example, you might be developing a system with the following 
characteristics: 

■ input port at OfOOO hex 
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■ output port at Of 100 hex 

■ program and data from 1000 through 3fff hex 

Suppose that the only thing that exists in your target system at this time 
are input and output ports and some control logic; no memory is 
available. You can reflect this by mapping the I/O ports to target 
system memory space and the rest of memory to emulation memory 
space. Type the following commands: 

R> map Of 000.. Of 100 tram 
R> map 1000.. 3fff eram 

R> map 

# remaining number of terms : 14 

# remaining emulation memory : 7e800h bytes 
map 001000 .. 003fff eram # term 1 

map OOf 000 . . OOf If f tram # term 2 

map other tram 

As you can see, the mapper rounded up the second term to 512 bytes 
block, since those are minimum size blocks supported by the H8/3003 
emulator. 



Note £9 When you use the internal ROM, you must map that area to emulation 

™ memory. When you power on the emulator, all memory space except 

internal RAM is mapped to target RAM. Therefore, if you don't map 
internal ROM properly, you cannot access that area. 
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You don't have to map internal RAM as emulation RAM, since the 
H8/3003 emulator automatically maps internal RAM as emulation 
RAM and this area is behaved like internal RAM. However emulation 
memory system does not introduce internal RAM area in memory 
mapping display. 



If you map internal RAM area as emulation memory, this area is 
behaved like external memory overlapped with internal RAM. 
However the H8/3003 emulator is always accessed internal RAM area 
mapped by the emulator. And if you map internal RAM as guarded 
memory, the emulator prohibits to access to this area by m commands. 



When you emulate H8/3005 processor, you can't use address OfeflOh - 
OffOOfh (mode 1) and OffeflOh - OfffOOfh (mode 3) as internal RAM. 
These area are worked as external 8bit 3 state area, and you have to map 
these area as emulation RAM. 



You should map all memory ranges except internal RAM used by your 
programs before loading programs into memory. This helps safeguard 
against loads which accidentally overwrite earlier loads if you follow a 
map/load procedure for each memory range. 



Executing this command will drive the emulator into the reset state. 
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For further information on mapping, refer to the examples in earlier 
chapters of this manual and to the HP 64700 Terminal Interface User's 
Reference manual. 

Break Conditions The be command lets you configure the emulator's response to various 

emulation system and external events. 

Write to ROM 

If you want the emulator to break into the emulation monitor whenever 
the user program attempts to write to a memory region mapped as 
ROM, enter: 

M> be -e rom 

You can disable this function by entering: 
M> be -d rom 

When disabled, the emulator will not break to the monitor upon a write 
to ROM. 



4 



Note nsl If emualator writes to the memory mapped as ROM or guarded area in 

internal DMA cycles, the emulator will not break to the monitor 
regardless of this configuration. 



Software Breakpoints 

The bp command allows you to insert software traps in your code 
which will cause a break to the emulation monitor when encountered 
during program execution. If you want to enable the insertion and use 
of software breakpoints by the bp command, enter: 

M> be -e bp 

To disable use of software breakpoints, type: 
M> be -d bp 

Any breakpoints which previously existed in memory are disabled, but 
are not removed from the breakpoint table. 
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Trigger Signals 

The HP 64700 emulator provides four different trigger signals which 
allow you to selectively start or stop measurements depending on the 
signal state. These are the bnct (rear panel BNC input), cmbt (CMB 
trigger input), trigl and trig2 signals (provided by the analyzer). 

You can configure the emulator to break to the monitor upon receipt of 
any of these signals. Simply type: 

M> be -e <signal> 

For example, to have the emulator break to monitor upon receipt of the 
trigl signal from the analyzer, type: 

M> be -e trigl 

(Note: in this situation, you must also configure the analyzer to drive 
the trigl signal upon finding its trigger by entering tgout trigl). 



Due to the architecture of the HP 64700 emulators, there are a wide 
variety of items that affect how the emulator interacts with your 
system, controller, and other measuring instruments. If you need more 
configuration information, we suggest the following strategy: 

If you need tutorial information -- 

■ Emulator: look at this manual. 

■ Analyzer: look at the Analyzer User's Guide and this manual. 

■ CMB: look at the CMB User's Guide. 
If you need reference information — 

■ Look at the Terminal Interface User's Reference manual (also 
contains some examples). 



Where to Find 
More Information 
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Notes 
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A 



H8/3003 Emulator Specific Command Syntax 



The following pages contain descriptions of command syntax specific 
to the H8/3003 emulator. The following syntax items are included 
(several items are part of other command syntax): 

■ <CONFIG_ITEMS>. May be specified in the cf (emulator 
configuration) and help cf commands. 

■ <ACCESS_MODE>. May be specified in the mo (display 
and access mode), m (memory), and ser (search memory for 
data) commands. The display mode is used when memory 
locations are displayed or modified. 

■ <ADDRESS>. May be specified in emulation commands 
which allow addresses to be entered. 

■ <REG_NAME>. May be specified in the reg (register) 
command. 

Command and error messages which are specific to the H8/3003 
emulator are also described in this chapter. 
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CONFIGJTEMS 

Summary H8/3003 emulator configuration items. 
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DeSCri ptiOII The H8/3003 emulator has several dedicated configuration items which 
allow you to specify the emulator's interaction with the target system 
and the rest of the emulation system. These items are: 



ba Enable/disable bus arbitration with target system. 

chip Select processor to be emulated. 

elk Select internal/external clock source. 

dbc Enable/disable to drive background cycles to target 

system. 

drst Enable/disable to drive reset to target system. 

mode Determine emulator processor operation mode. 

nmi Enable/disable NMI (non maskable interrupt) from 

target system. 

rrt Restrict emulator to real time runs. 

rsp Specify system stack pointer value to load upon 

each transition from emulation reset to the monitor. 

tdma Enable/disable tracing internal DMA cycles. 

trfsh Enable/disable tracing refresh cycles. 

trst Enable/disable target system reset. 



Complete explanations of all configuration items are given in chapter 4 
of this manual. 
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Examples 



To select an external clock, type: 



M> cf clk=ext 

You can obtain the status of configuration items by typing the item 
name without a value. You can also specify multiple configuration 
items on the same line. Type: 

M> cf nmi=dis rrt=dis elk 



cf clk=ext 



Related information 



Refer to the cf syntax pages in the User's Reference manual. Also, refer 
to chapter 3 of this manual for complete information about each 
configuration item. 



ACCESS MODE 
and DISPLAY 
MODE 



Summary Specify the memory display format or the size of memory locations to 
be modified. 



Syntax 



> 



Byte. Memory is accessed in a byte format, and 
when memory locations are modified, bytes are 
changed. 
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w 



Word. Memory is accessed in a word format, and 
when memory locations are modified, words are 
changed. 



1 Long word. Memory is accessed in a long word 

format, and when memory locations are modified, 
long words are changed. 

m Mnemonic. Memory is displayed in mnemonic 

format; that is, the contents of memory locations are 
inverse-assembled into mnemonics and operands. 
When memory locations are modified, the last 
non-mnemonic display mode specification is used. 
You cannot specify this display mode in the ser 
(search memory for data) command. 



Note n When the <ACCESS_MODE> is w, modifying target memory will 

*W fail if you try to modify memory from an odd address or with data 

which byte count is odd. Also, you can't load file which byte count is 
odd. Therefore, it is recommended to use the emulator with the default 
<ACCESS_MODE> (b). 



Def ail ItS The <ACCESS_MODE> is b at power up initialization. Display mode 
specifications are saved; that is, when a command changes the display 
mode, the new display mode becomes the current default. 

Related Information Refer to the mo syntax information in the User's Reference manual for 

further information on use of the mode command. 



H8/3003 Emulator Specific Command Syntax A-5 



ADDRESS 

Summary 
Description 

Examples 



Address specification used in emulation commands. 

The <ADDRESS> parameter used in emulation commands is specified 
in 24 bits address information. 

mlOOO 

m 200000..2000ff 
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REGISTER CLASS 
and NAME 



Summary H8/3003 register designators. All available register class names and 
register names are listed below. 

<REG_CLASS> 

<REG_NAME> Description 

* (All basic registers) 



pc Program counter 

ccr Condition code register 

erO Register ERO 

erl Register ER1 

er2 Register ER2 

er3 Register ER3 

er4 Register ER4 

er5 Register ER5 

er6 Register ER6 

er7 Register ER7 

sp Stack pointer 

m dcr Mode control register(Read Only) 

sys (System control) 

mdcr Mode control register(Read Only) 

syscr System control register 

intc (Interrupt controller) 

iscr IRQ sense control register 

ier IRQ enable register 

isr IRQ status register 

ipra Interrupt priority register A 

iprb Interrupt priority register B 
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busc (Bus controller) 



abwcr Byte/Word area control register * 

aster 2/3 state area control register 

wcr Wait control register 

wcer Wait controller enable register 

brer Bus release control register * 



* Except 3030, 3031,3032 
rfshcr (Refresh controller) 

The following registers does not exist in 3030, 303 1, and 3032 

rfshcr Refresh control register 

rtmcsr Refresh timer control/status register 

rtcnt Refresh timer counter 

rtcor Refresh time constant register 

dmacO (DMA controller 0) 

The following registers does not exist in 3030, 303 1, and 3032 



marOa 


Memory address register OA 


etcrOa 


Transfer count register OA 


ioarOa 


I/O address register OA 


dtcrOa 


Data transfer control register OA 


marOb 


Memory address register 0B 


etcrOb 


Transfer count register 0B 


ioarOb 


I/O address register 0B 


dtcr 0b 


Data transfer control register 0B 
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dmad (DMA controller 1) 



The following registers does not exist in 3030, 303 1, and 3032 



marl a 


Memory address register 1A 


etcrla 


Transfer count register 1 A 


ioarla 


I/O address register 1A 


dtcrla 


Data transfer control register 1A 


marlb 


Memory address register IB 


etcrlb 


Transfer count register IB 


ioarlb 


I/O address register IB 


dtcr lb 


Data transfer control register IB 



dmac2 (DMA controller 2) 

The following registers does not exist in 3002, 3030, 3031, 3032 and 
3042 



mar2a 


Memory address register 2A 


etcr2a 


Transfer count register 2A 


ioar2a 


I/O address register 2A 


dtcr2a 


Data transfer control register 2A 


mar2b 


Memory address register 2B 


etcr2b 


Transfer count register 2B 


ioar2b 


I/O address register 2B 


dtcr 2b 


Data transfer control register 2B 



dmac3 (DMA controller 3) 

The following registers does not exist in 3002, 3030, 3031, 3032 and 
3042 



mar3a 


Memory address register 3A 


etcr3a 


Transfer count register 3A 


ioar3a 


I/O address register 3A 


dtcr3a 


Data transfer control register 3A 


mar3b 


Memory address register 3B 


etcr3b 


Transfer count register 3B 


ioar3b 


I/O address register 3B 


dtcr 3b 


Data transfer control register 3B 
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port (I/O port) 




plddr 


Port 1 data direction register( Write Only)* 1,2 


p2ddr 


Port 2 data direction register( Write Only)* 1,2 


p3ddr 


Port 3 data direction register( Write Only)* 1,2 


p4ddr 


Port 4 data direction register(Write Only)*5 


p5ddr 


Port 5 data direction register(Write Only)* 1 


p6ddr 


Port 6 data direction register(Write Only)* 1 


p8ddr 


Port 8 data direction register(Write Only) 


p9ddr 


Port 9 data direction register(Write Only) 


p addr 


Port A data direction register(Write Only) 


pbddr 


Port B data direction register(Write Only) 


pcddr 


Port C data direction register( Write Only)* 1,3,5 


pldr 


Port 1 data register* 1,2 


p2dr 


Port 2 data register* 1 ,2 


p3dr 


Port 3 data register* 1,2 


p4dr 


Port 4 data register*5 


p5dr 


Port 5 data register* 1 


p6dr 


Port 6 data register 


p7dr 


Port 7 data register( Write Only) 


p8dr 


Port 8 data register 


p9dr 


Port 9 data register 


padr 


Port A data register 


pbdr 


Port B data register 


pcdr 


Port C data register* 1,3,5 


p2pcr 


Port 2 input pull up MOS control register * 1,2,4 


p4pcr 


Port 4 input pull up MOS control register *4,5 


p5pcr 


Port 5 input pull up MOS control register *1,4 



*1 Except 3002 



*2 Except 3003 

*3 Except 3042 

*4 NOT effective 

*5 Except 3030, 3031,3032 
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itug (16 bit integrated timer pulse unit general) 



tstr Timer start register 

tsnc Timer synchro register 

tmdr Timer mode register 

tfcr Timer function control register 

toer Timer output master control register 

tocr Timer output control register 

ituO (16 bit integrated timer pulse unit 0) 

tcrO Timer control register 0 

tiorO Timer I/O control register 0 

tierO Timer interrupt enable register 0 

tsrO Timer status register 0 

tcntO Timer counter 0 

graO General register AO 

grbO General register BO 

itu1 (16 bit integrated timer pulse unit 1) 

tcrl Timer control register 1 

tiorl Timer I/O control register 1 

tierl Timer interrupt enable register 1 

tsrl Timer status register 1 

tcntl Timer counter 1 

gral General register Al 

grb 1 General register B 1 

itu2 (16 bit integrated timer pulse unit 2) 

tcr2 Timer control register 2 

tior2 Timer I/O control register 2 

tier2 Timer interrupt enable register 2 

tsr2 Timer status register 2 

tcnt2 Timer counter 2 

gra2 General register A2 

grb2 General register B2 
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itu3 (16 bit integrated timer pulse unit 3) 



tcr3 


Timer control register 3 


tior3 


Timer I/O control register 3 


tier3 


Timer interrupt enable register 3 


tsr3 


Timer status register 3 


tcnt3 


Timer counter 3 


gra3 


General register A3 


grb3 


General register B3 


bra3 


Buffer register A3 


brb3 


Buffer register B3 


itu4 (16 bit integrated timer pulse unit 4) 


tcr4 


Timer control register 4 


tior4 


Timer I/O control register 4 


tier4 


Timer interrupt enable register 4 


tsr4 


Timer status register 4 


tcnt4 


Timer counter 4 


gra4 


General register A4 


grb4 


General register B4 


bra4 


Buffer register A4 


brb4 


Buffer register B4 



tpc (Programable timing pattern controller) 



tpmr 


TPC output mode register 




tpcr 


TPC output control register 




ndera 


Next data enable register A 




ndra 


Next data register A (address: 


0xxffa5h) 


ndraO 


Next data register A (address: 


0xxffa7h) 


nderb 


Next date enable register B 




ndrb 


Next data register B (address: 


0xxffa4h) 


ndrb2 


Next data register B (address: 


0xxffa6h) 


wdt (Watch dog timer) 




wdtcsr 


Timer control/status register 




wdtcnt 


Timer counter 




rstcsr 


Reset control/status register 
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sciO (Serial communication interface 0) 



smrO Serial mode register 0 

brrO Bit rate register 0 

scrO Serial control register 0 

tdrO Transmit data register 0 

ssrO Serial status register 0 

rdrO Receive data register 0 (Read Only) 

scil (Serial communication interface 1) 

The following registers does not exist in 3030, 303 1, and 3032 

smrl Serial mode register 1 

brrl Bit rate register 1 

scrl Serial control register 1 

tdrl Transmit data register 1 

ssrl Serial status register 1 

rdrl Receive data register 1 (Read Only) 

adc (A/D converter) 

addra A/D data register A (Read Only) 

addrb A/D data register B (Read Only) 

addrc A/D data register C (Read Only) 

addrd A/D data register D (Read Only) 

adcsr A/D control/status register 

adcr A/D control register 

dac (D/A converter) 

The following registers does not exist in 3002, 3003, 3030, 3031, and 
3032 

dadrO D/A data register 0 

dadrl D/A data register 1 

dacr D/A control register 
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NOCLASS 



The following register names are not included in any register class. 



rO 


Register RO 


rl 


Register Rl 


r2 


Register R2 


r3 


Register R3 


r4 


Register R4 


r5 


Register R5 


r6 


Register R6 


r7 


Register R7 


eO 


Register EO 


el 


Register El 


e2 


Register E2 


e3 


Register E3 


e4 


Register E4 


e5 


Register E5 


e6 


Register E6 


e7 


Register E7 


rOh 


Register ROH 


rOl 


Register ROL 


rlh 


Register R1H 


rll 


Register R1L 


r2h 


Register R2H 


r21 


Register R2L 


r3h 


Register R3H 


r31 


Register R3L 


r4h 


Register R4H 


r41 


Register R4L 


r5h 


Register R5H 


r51 


Register R5L 


r6h 


Register R6H 


r61 


Register R6L 


r7h 


Register R7H 


r71 


Register R7L 
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Emulator Specific 
Error Messages 



The following is the error messages which are specific to the H8/3003 
emulator. The cause of the errors is described, as well as the action you 
must take to remedy the situation. 



Message 140 : Stack is in I/O registers 



Cause 

This error occurs when you attempt to execute user program (with r or s 
command) with the stack pointer set at internal I/O register area. 

Action 

Set up the stack pointer with cf rsp command. Refer to chapter 3 of this 
manual for more information. 

Message 141 : Invalid address for run or step in current mode 



Cause 

This error occurs when you attempt to execute user program (with r or s 
command) from address over area of current mode. 

Message 170 : Emulation memory card not found in card cage 



Cause 

This error occurs when you don't insert memory board in card cage, or 
connect memory board which is not supported. 

Action 

Insert correct memory board. 
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Notes 
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Index 



A ADDRESS syntax, A-6 
Analyzer 

configuration, 2-23 
configuration commands, 4-2 
halting, 2-25 

matters to be attended to, 2-30 
pipeline, 2-25 

storage specification, 2-23 - 2-24 
trace, 2-22 

trace list display, 2-24 
trace list format, 2-24 
trigger, 2-23 

trigger specification, 2-23 

triggering by data, 2-34 
analyzer status 

predefined equates, 2-23 
Analyzer trace 

starting, 2-24 

B b Command, 2-19 

be Command, 2-10, 2-27, 4-18 

Before using the emulator, 2-2 

bp Command, 2-27, 4-18 

Break 

write to ROM, 4-18 

Break condition, 2-27 

Breaks, 4-18 

Bus arbitration 

configure emulator's response, 4-4 

using configuration to isolate target problem, 4-4 

C cf ba Command, 4-4 
cf chip Command, 4-5 
cf elk Command, 4-6 
cf Command, 2-9, 4-3 
cf dbc Command, 4-7 



lndex-1 



cf drst Command, 4-8 

cf mode Command, 4-9 

cf nmi Command, 4-11 

cf rrt Command, 4-11 

cf rsp Command, 4-12 

cf tdma Command, 4-13 

cf trfsh Command, 4-13 

cf trst Command, 4-14 

cim Command, 2-27 

Clock selection for microprocessor, 4-6 

Command help, 2-7 

Command prompts, 2-19 

Command syntax, specific to H8/3003 emulator, A-l 
Commands 

analyzer configuration, 4-2 

b, 2-19 

be, 2-10, 2-27, 4-18 

bp, 2-27, 4-18 

cf, 2-9, 4-3 

cf ba, 4-4 

cf chip, 4-5 

cf elk, 4-6 

cfdbc, 4-7 

cf drst, 4-8 

cf mode, 4-9 

cf nmi, 4-11 

cfrrt, 4-11 

cf rsp, 4-12 

cf tdma, 4-13 

cf trfsh, 4-13 

cf trst, 4-14 

cim, 2-27 

configuration, 4-1 

coordinated measurement, 4-2 

cov, 2-29 

help, 2-7 

init, 2-8 

load, 2-16 

m, 2-13, 2-21 

map, 2-11, 4-15 

measurement, 4-2 
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r, 2-19 - 2-20 

reg, 2-20 

rst, 2-19 

s, 2-22 

ser, 2-29 

system, 4-2 

t, 2-24 

tf, 2-24 

tg, 2-24 

th, 2-25 

tinit, 2-30 

tl, 2-24 

tp, 2-31 

tsto, 2-24, 2-32 

xp, 2-15 
CONFIGJTEMS syntax, A-2 
Configuration 

analyzer, 4-2 

breaks, 4-18 

bus arbitration, 4-4 

clock selection, 4-6 

displaying, 4-3 

drive background cycles to target, 4-7 

drive emulation reset to target, 4-8 

enable/disable target interrupts, 4-11 

enable/disable target system reset, 4-14 

enable/disable to trace DMA cycles, 4-13 

enable/disable to trace refresh cycles, 4-13 

for getting started, 2-9, 2-11 

hardware standby, 4-14 

internal RAM, 4-17 

measurement commands, 4-2 

memory mapping, 4-15 

microprocessor operation mode, 4-9 

microprocessor selection, 4-5 

processor to emulator/target system, 4-1, 4-3 

restrict to real-time runs, 4-11 

stack pointer, 4-12 

system, 4-2 

to access the internal ROM, 4-16 
types of, 4-1 
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Coordinated measurement commands, 4-2 
cov Command, 2-29 
Coverage measurement, 2-29 

D Displaying 

configuration, 4-3 
memory, 2-21 
registers, 2-20 
trace list, 2-24 
DMA cycles 

enable/disable tracing DMA cycles, 4-13 

E electrical characteristics, 3-13 
Emulator 

configuration, 2-9, 2-11 

initialization, 2-8 

purpose, 1-1 
Emulator features, 1-3 

analyzer, 1-7 

breakpoints, 1-7 

clock speeds, 1-5 

emulation memory, 1-7 

processor reset control, 1-8 

register display/modify, 1-7 

restrict to real-time runs, 1-8 

supported microprocessors, 1-3 
Emulator limitations, 1-9 
Emulator specific command syntax, A-l 
equates predefined for analyzer status, 2-23 
Evaluation chip, 1-10 

F Function codes 

memory mapping, 4-15 

H H8/3003 microprocessor 

installation procedure, 3-9 
Halting the analyzer, 2-25 
Help, 2-7 

help Command, 2-7 

I In-circuit emulation 

H8/3001 with mode 3/4, 3-3 
H8/3004/5 with mode 3, 3-3 
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installing the PGA adaptor, 3-6, 3-11 

installing the QFP adaptor, 3-5 

PGA adaptor, 3-3 

QFP adaptor, 3-3 

QFP probe, 3-4 

QFP socket/adaptor, 3-4 
Information help, 2-7 
init Command, 2-8 
Initializing the Emulator, 2-8 
installing H8/3003 microprocessor, 3-9 
Installing target system probe 

target system probe, 3-2 
internal RAM 

mapping, 4-17 
Internal ROM access, 4-16 
Interrupts 

enable/disable from target system, 4-11 

L labels (trace), predefined, 2-22 

limitations 

DMA support, 1-9 
Hardware standby mode, 1-9, 4-14 
internal RAM of H8/3005, 1-9 
Interrupts in background, 1-9 
Reset output enable bit, 1-9 
Sleep/standby mode, 1-9 
store condition and trace, 2-32 
Watch dog timer in background, 1-9 

load Command, 2-16 

Loading programs, 2-12 

for Standalone Configuration, 2-12 
for Transparent Configuration, 2-15 
load command, 2-16 
transfer utility, 2-15 

low voltage adaptor 
installation, 3-10 
specification, 3-10 

M m Command, 2-13, 2-21 
map Command, 2-11, 4-15 
mapping of internal RAM, 4-17 
Measurement commands, 4-2 
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Memory Display, 2-21 

mnemonic format, 2-18 
Memory mapping, 4-15 

defining memory type to emulator, 4-15 

function codes, 4-15 

sequence of map/load commands, 4-17 
Memory search, 2-29 
Mnemonic display format, 2-18 

N notes 

/STB Y input will give the emulator /RES input, 4-14 
mapping of internal RAM, 4-17 

P PGA adaptor, 3-3 

installation procedure, 3-6, 3-11 

predefined equates, 2-23 

predefined trace labels, 2-22 

Predefining stack pointer, 4-12 

Prerequisites for using the emulator, 2-2 

Processor clock selection, 4-6 

Program loads, 2-12 

Program tracing, 2-22 

Prompts 

emulator command, 2-19 

Purpose of the Emulator, 1-1 

Q QFP adaptor, 3-3 

installation procedure, 3-5 
QFP probe, 3-4 
QFP socket/adaptor, 3-4 

R r Command, 2-19 - 2-20 
Real-time runs 

restricting emulator to, 4-11 
Refresh cycles 

enable/disable tracing refresh cycles, 4-13 
reg Command, 2-20 
REGISTER CLASS, A-7 
Register Display, 2-20 
REGISTER NAME , A-7 
Restrict to real time runs, 4-11 

permissible commands, 4-11 

target system dependency, 4-12 
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rst Command, 2-19 

RSTOE, 1-9 

run from reset, 3-12 

S s Command, 2-22 
Sample programs 

for getting started, 2-3 
ser Command, 2-29 
Single step, 2-22 
Software breakpoints, 2-27, 4-18 

defining in target ROM, 2-27 
specification 

low voltage adaptor, 3-10, 3-12 
Stack pointer 

predefining, 4-12 
Starting a trace, 2-24 

stat (emulation analyzer status) trace label, 2-23 
Storage qualifier, 2-24 

Syntax (command), specific to H8/3003 emulator, A-l 
System commands, 4-2 

T t Command, 2-24 
target system 

H8/3001 with mode 3/4, 3-3 

H8/3004/5 with mode 3, 3-3 

interface, 3-26 

PGA adaptor, 3-3 

QFP adaptor, 3-3 - 3-4 
Target system dependency on executing code, 4-12 
Target system interrupts 

enable/disable, 4-11 
Target system probe 

installation, 3-2 
target system reset, 4-14 

run from reset, 3-12 
tf Command, 2-24 
tg Command, 2-24 
th Command, 2-25 
tinit Command, 2-30 
tl Command, 2-24 

tlb (display/modify trace labels) command, 2-22 
tp Command, 2-31 
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trace labels, predefined, 2-22 
Trace list display, 2-24 
Trace list format, 2-24 
Tracing program execution, 2-22 
Transfer utility, 2-15 
Transparent mode, 2-15 
Trigger signals 

break upon, 4-19 
tsto Command, 2-24 

effect on the analyzer, 2-32 
Types of configuration, 4-1 

X xp Command, 2-15 
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